diff --git a/typo3/sysext/felogin/Classes/Redirect/RedirectModeHandler.php b/typo3/sysext/felogin/Classes/Redirect/RedirectModeHandler.php index bda8381803c86043785ee998556453907a4d1e5e..c6496d15f250e62e4a330bc015de21a23e997138 100644 --- a/typo3/sysext/felogin/Classes/Redirect/RedirectModeHandler.php +++ b/typo3/sysext/felogin/Classes/Redirect/RedirectModeHandler.php @@ -141,7 +141,7 @@ class RedirectModeHandler $redirectUrl = ''; if ($redirectReferrer !== 'off') { // Avoid forced logout, when trying to login immediately after a logout - $redirectUrl = preg_replace('/[&?]logintype=[a-z]+/', '', $this->getRefererRequestParam()); + $redirectUrl = preg_replace('/[&?]logintype=[a-z]+/', '', $this->getReferer()); } return $redirectUrl ?? ''; @@ -163,7 +163,7 @@ class RedirectModeHandler // Thanks to plan2.net / Martin Kutschker for implementing this feature. // also avoid redirect when logging in after changing password if ($domains) { - $url = $this->getRefererRequestParam(); + $url = $this->getReferer(); // Is referring url allowed to redirect? $match = []; if (preg_match('#^http://([[:alnum:]._-]+)/#', $url, $match)) { @@ -222,10 +222,14 @@ class RedirectModeHandler return $this->uriBuilder->build(); } - protected function getRefererRequestParam(): string + protected function getReferer(): string { $referer = ''; $requestReferer = (string)$this->serverRequestHandler->getPropertyFromGetAndPost('referer'); + if ($requestReferer === '') { + $requestReferer = $this->serverRequestHandler->getHttpReferer(); + } + if ($this->redirectUrlValidator->isValid($requestReferer)) { $referer = $requestReferer; } diff --git a/typo3/sysext/felogin/Classes/Redirect/ServerRequestHandler.php b/typo3/sysext/felogin/Classes/Redirect/ServerRequestHandler.php index 497e3cbac5fe972158b93a1443cdd0011fc3cab4..b5a18d6adc00e6c60ae11b7c797db2daaf8a0c09 100644 --- a/typo3/sysext/felogin/Classes/Redirect/ServerRequestHandler.php +++ b/typo3/sysext/felogin/Classes/Redirect/ServerRequestHandler.php @@ -59,6 +59,14 @@ class ServerRequestHandler )[$propertyName] ?? null; } + /** + * Returns the HTTP_REFERER from server request parameters if set + */ + public function getHttpReferer(): string + { + return $this->request->getServerParams()['HTTP_REFERER'] ?? ''; + } + /** * Returns validated redirect url contained in request param return_url or redirect_url */