From b63bd9977c436f6ad564d429e663bb580bb4e730 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 18 Aug 2016 11:18:21 +0200 Subject: [PATCH] Stricter validation of NavigationLogoLink MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It now has to be URL including scheme. Otherwise it's not really possible to validate it for being just http/https. Signed-off-by: Michal Čihař --- libraries/navigation/NavigationHeader.php | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/libraries/navigation/NavigationHeader.php b/libraries/navigation/NavigationHeader.php index 6b1b5e8c13..bd8d59bef2 100644 --- a/libraries/navigation/NavigationHeader.php +++ b/libraries/navigation/NavigationHeader.php @@ -106,11 +106,9 @@ class NavigationHeader $logoLink = trim( htmlspecialchars($GLOBALS['cfg']['NavigationLogoLink']) ); - // prevent XSS, see PMASA-2013-9 - // if link has protocol, allow only http and https - if (preg_match('/^[a-z]+:/i', $logoLink) - && !preg_match('/^https?:/i', $logoLink) - ) { + $parsed = parse_url($logoLink); + /* Allow only links with http/https */ + if (! isset($parsed['scheme']) || ! in_array(strtolower($parsed['scheme']), array('http', 'https'))) { $logoLink = 'index.php'; } switch ($GLOBALS['cfg']['NavigationLogoLinkWindow']) {