xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-13 06:41:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix Open Redirect via Unvalidated HTTP_REFERER Header in Admin Panel After Login and Admin Actions

Browse Source 
Open Redirect via Unvalidated HTTP_REFERER Header in Admin Panel After Login and Admin Actions
This commit is contained in:
novgorodschi catalin
2026-07-03 10:34:30 +03:00
parent 3c401e46f7
commit cba3ce80cc
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
GameEngine/Admin/function.php
+9 -9
View File
@@ -28,6 +28,11 @@ class funct
{ {
return isset($_SESSION['access']) && $_SESSION['access'] >= MULTIHUNTER && $_SESSION['id']; return isset($_SESSION['access']) && $_SESSION['access'] >= MULTIHUNTER && $_SESSION['id'];
} }
private function safeRedirect(){
header('Location: admin.php');
exit;
}
function Act($get) function Act($get)
{ {
@@ -221,11 +226,7 @@ class funct
header("Location: admin.php?p=player&uid=" . $get['uid'] . "&ac=1"); header("Location: admin.php?p=player&uid=" . $get['uid'] . "&ac=1");
exit(); exit();
} }
if ($get['action'] == 'logout') { $this->safeRedirect();
header("Location: admin.php");
} else {
header("Location: " . $_SERVER['HTTP_REFERER']);
}
} }
function Act2($post) function Act2($post)
@@ -241,11 +242,11 @@ class funct
break; break;
case "punish": case "punish":
$admin->Punish($post); $admin->Punish($post);
header("Location: " . $_SERVER['HTTP_REFERER']); $this->safeRedirect();
break; break;
case "addVillage": case "addVillage":
$admin->AddVillage($post); $admin->AddVillage($post);
header("Location: " . $_SERVER['HTTP_REFERER']); $this->safeRedirect();
break; break;
} }
} }
@@ -257,8 +258,7 @@ class funct
$_SESSION['admin_username'] = $username; $_SESSION['admin_username'] = $username;
$_SESSION['access'] = $database->getUserField($username, 'access', 1); $_SESSION['access'] = $database->getUserField($username, 'access', 1);
$_SESSION['id'] = $database->getUserField($username, 'id', 1); $_SESSION['id'] = $database->getUserField($username, 'id', 1);
header("Location: " . $_SERVER['HTTP_REFERER']); $this->safeRedirect();
// header("Location: admin.php");
} else { } else {
echo "Error"; echo "Error";
} }