diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Security] Fix exception when use_referer option is true and referer is not set or empty

Browse Source
This commit is contained in:
Sergey Linnik 2017-09-05 10:54:44 +03:00 committed by Fabien Potencier
parent d74144fc0b
commit a29e0694de
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/Symfony/Component/Security/Http/Authentication/DefaultAuthenticationSuccessHandler.php
View File

@ -118,12 +118,11 @@ class DefaultAuthenticationSuccessHandler implements AuthenticationSuccessHandle
return $targetUrl; return $targetUrl;
} }
if ($this->options['use_referer']) { if ($this->options['use_referer'] && $targetUrl = $request->headers->get('Referer')) {
$targetUrl = $request->headers->get('Referer');
if (false !== $pos = strpos($targetUrl, '?')) { if (false !== $pos = strpos($targetUrl, '?')) {
$targetUrl = substr($targetUrl, 0, $pos); $targetUrl = substr($targetUrl, 0, $pos);
} }
if ($targetUrl !== $this->httpUtils->generateUri($request, $this->options['login_path'])) { if ($targetUrl && $targetUrl !== $this->httpUtils->generateUri($request, $this->options['login_path'])) {
return $targetUrl; return $targetUrl;
} }
} }

10
src/Symfony/Component/Security/Http/Tests/Authentication/DefaultAuthenticationSuccessHandlerTest.php
View File

@ -83,6 +83,16 @@ class DefaultAuthenticationSuccessHandlerTest extends TestCase
array(), array(),
'/', '/',
), ),
'target path as referer when referer not set' => array(
Request::create('/'),
array('use_referer' => true),
'/',
),
'target path as referer when referer is ?' => array(
Request::create('/', 'GET', array(), array(), array(), array('HTTP_REFERER' => '?')),
array('use_referer' => true),
'/',
),
'target path should be different than login URL' => array( 'target path should be different than login URL' => array(
Request::create('/', 'GET', array(), array(), array(), array('HTTP_REFERER' => 'http://localhost/login')), Request::create('/', 'GET', array(), array(), array(), array('HTTP_REFERER' => 'http://localhost/login')),
array('use_referer' => true, 'login_path' => '/login'), array('use_referer' => true, 'login_path' => '/login'),