From ac629148b6ce0cc10ae7a85ab1af13d4c7410855 Mon Sep 17 00:00:00 2001
From: Torben Hansen <derhansen@gmail.com>
Date: Thu, 22 Dec 2022 19:39:22 +0100
Subject: [PATCH] [BUGFIX] Respect HTTP_REFERER for felogin redirect mode
'referer'
The `redirectMode=referer` configuration allows to process a redirect
after a successful login to an evaluated referer value.
For the legacy version of the felogin plugin, the referer value has
been evaluated using the GET/POST parameter `referer` and the
`HTTP_REFERER` as fallback.
The extbase version of the felogin plugin currently only evaluates the
GET/POST parameter `referer`.
This patch adds the missing `HTTP_REFERER` fallback evaluation
of the referer.
Resolves: #91844
Releases: main, 11.5
Signed-off-by: Torben Hansen <derhansen@gmail.com>
Change-Id: Id4119b0425ddca09a350f4d8d8a6ebb4d3b3135b
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77401
Tested-by: core-ci <typo3@b13.com>
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
---
.../felogin/Classes/Redirect/RedirectModeHandler.php | 10 +++++++---
.../felogin/Classes/Redirect/ServerRequestHandler.php | 8 ++++++++
2 files changed, 15 insertions(+), 3 deletions(-)
diff --git a/typo3/sysext/felogin/Classes/Redirect/RedirectModeHandler.php b/typo3/sysext/felogin/Classes/Redirect/RedirectModeHandler.php
index bda8381803c8..c6496d15f250 100644
--- a/typo3/sysext/felogin/Classes/Redirect/RedirectModeHandler.php
+++ b/typo3/sysext/felogin/Classes/Redirect/RedirectModeHandler.php
@@ -141,7 +141,7 @@ class RedirectModeHandler
$redirectUrl = '';
if ($redirectReferrer !== 'off') {
// Avoid forced logout, when trying to login immediately after a logout
- $redirectUrl = preg_replace('/[&?]logintype=[a-z]+/', '', $this->getRefererRequestParam());
+ $redirectUrl = preg_replace('/[&?]logintype=[a-z]+/', '', $this->getReferer());
}
return $redirectUrl ?? '';
@@ -163,7 +163,7 @@ class RedirectModeHandler
// Thanks to plan2.net / Martin Kutschker for implementing this feature.
// also avoid redirect when logging in after changing password
if ($domains) {
- $url = $this->getRefererRequestParam();
+ $url = $this->getReferer();
// Is referring url allowed to redirect?
$match = [];
if (preg_match('#^http://([[:alnum:]._-]+)/#', $url, $match)) {
@@ -222,10 +222,14 @@ class RedirectModeHandler
return $this->uriBuilder->build();
}
- protected function getRefererRequestParam(): string
+ protected function getReferer(): string
{
$referer = '';
$requestReferer = (string)$this->serverRequestHandler->getPropertyFromGetAndPost('referer');
+ if ($requestReferer === '') {
+ $requestReferer = $this->serverRequestHandler->getHttpReferer();
+ }
+
if ($this->redirectUrlValidator->isValid($requestReferer)) {
$referer = $requestReferer;
}
diff --git a/typo3/sysext/felogin/Classes/Redirect/ServerRequestHandler.php b/typo3/sysext/felogin/Classes/Redirect/ServerRequestHandler.php
index 497e3cbac5fe..b5a18d6adc00 100644
--- a/typo3/sysext/felogin/Classes/Redirect/ServerRequestHandler.php
+++ b/typo3/sysext/felogin/Classes/Redirect/ServerRequestHandler.php
@@ -59,6 +59,14 @@ class ServerRequestHandler
)[$propertyName] ?? null;
}
+ /**
+ * Returns the HTTP_REFERER from server request parameters if set
+ */
+ public function getHttpReferer(): string
+ {
+ return $this->request->getServerParams()['HTTP_REFERER'] ?? '';
+ }
+
/**
* Returns validated redirect url contained in request param return_url or redirect_url
*/
--
GitLab