michael/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2026-06-01 18:50:26 +01:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Check port on referer

Browse Source
This commit is contained in:
Jamie Cameron
2012-09-21 09:43:26 -07:00
parent 249d96b0bd
commit 449ef784f9
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
web-lib-funcs.pl
View File

@@ -4456,12 +4456,17 @@ if ($module_name && !$main::no_acl_check &&
my @referers = split(/\s+/, $gconfig{'referers'});
my $referer_site;
my $r = $ENV{'HTTP_REFERER'};
if ($r =~ /^(http|https|ftp):\/\/([^:\/]+:[^@\/]+@)?\[([^\]]+)\]/ ||
$r =~ /^(http|https|ftp):\/\/([^:\/]+:[^@\/]+@)?([^\/:@]+)/) {
my $referer_port = $r =~ /^https:/ ? 443 : 80;
if ($r =~ /^(http|https|ftp):\/\/([^:\/]+:[^@\/]+@)?\[([^\]]+)\](:(\d+))?/ ||
$r =~ /^(http|https|ftp):\/\/([^:\/]+:[^@\/]+@)?([^\/:@]+)(:(\d+))?/) {
$referer_site = $3;
$referer_port = $5;
}
my $http_host = $ENV{'HTTP_HOST'};
$http_host =~ s/:\d+$//;
my $http_port = 80;
if ($http_host =~ s/:(\d+)$//) {
$http_port = $1;
}
$http_host =~ s/^\[(\S+)\]$/$1/;
my $unsafe_index = $unsafe_index_cgi ||
&get_module_variable('$unsafe_index_cgi');
@@ -4474,7 +4479,8 @@ if ($0 &&
$ENV{'HTTP_USER_AGENT'} !~ /^Webmin/i &&
($referer_site && $referer_site ne $http_host &&
&indexof($referer_site, @referers) < 0 ||
!$referer_site && $gconfig{'referers_none'}) &&
!$referer_site && $gconfig{'referers_none'} ||
$referer_port && $http_port && $referer_port != $http_port) &&
!$trust_unknown_referers &&
!&get_module_variable('$trust_unknown_referers')) {
# Looks like a link from elsewhere .. show an error