diff --git a/web-lib-funcs.pl b/web-lib-funcs.pl index 92874141a..5ee16107d 100755 --- a/web-lib-funcs.pl +++ b/web-lib-funcs.pl @@ -5249,39 +5249,41 @@ if ($ENV{'HTTP_X_REQUESTED_WITH'} ne "XMLHttpRequest" && $ENV{'REQUEST_URI'} !~ /pjax/ && $ENV{'REQUEST_URI'} !~ /link.cgi\/\d+/ && $ENV{'REQUEST_URI'} =~ /xnavigation=1/) { - # Store requested URI if safe - if ($main::session_id && $remote_user) { - my %var; - my $key = 'goto'; - my $xnav = "xnavigation=1"; - my $url = "@{[&get_webprefix()]}$ENV{'REQUEST_URI'}"; - my $salt = substr(encode_base64($main::session_id), 0, 16); - $url =~ s/[?|&]$xnav//g; - $salt =~ tr/A-Za-z0-9//cd; + my $urlbase = &get_webprefix(); + # Store request URI, if safe + if ($main::session_id && $remote_user) { + my %var; + my $key = 'goto'; + my $xnav = "xnavigation=1"; + my $url = "$urlbase$ENV{'REQUEST_URI'}"; + my $salt = substr(encode_base64($main::session_id), 0, 16); + $url =~ s/[?|&]$xnav//g; + $salt =~ tr/A-Za-z0-9//cd; - if (!$trust) { - my @parent_dir = split('/', $url); - $url = &get_webprefix() ? $parent_dir[2] : $parent_dir[1]; - if ($url =~ /.cgi/) { - $url = "/"; - } - else { - $url = "/" . $url . "/"; - } - } - # Append random string to stored file name, to process multiple, simultaneous requests - my $url_salt = int(rand() * 10000000); - $var{$key} = $url; + if (!$trust) { + my @parent_dir = split('/', $url); + $url = &get_webprefix() ? $parent_dir[2] : $parent_dir[1]; + # Redirect to root in case of no module, i.e. /sysinfo.cgi + if ($url =~ /\.cgi/) { + $url = "/"; + } + # Redirect to module's root, i.e. /apache/ + else { + $url = "/" . $url . "/"; + } + } + # Append random string to stored file name, to process multiple, simultaneous requests + my $url_salt = int(rand() * 10000000); + $var{$key} = $url; - # Write follow URL only once - if (!$main::redirect_built) { - $main::ignore_errors = 1; - &write_file(tempname('.theme_' . $salt . '_' . $url_salt . '_' . get_product_name() . '_' . $key . '_' . $remote_user), \%var); - $main::ignore_errors = 0; - } - $main::redirect_built++; - } - &redirect("/"); + # Write URL for the theme to read and open + if (!$main::redirect_built++) { + $main::ignore_errors = 1; + &write_file(tempname('.theme_' . $salt . '_' . $url_salt . '_' . get_product_name() . '_' . $key . '_' . $remote_user), \%var); + $main::ignore_errors = 0; + } + } + &redirect("$urlbase/"); } if (!$trust) { # Looks like a link from elsewhere .. show an error