fix unescaped parameter, see PMASA-2013-8 for details
[phpmyadmin.git] / url.php
blobf3954ff1db4ac316fd7dd51e4b74523b7baccf27
1 <?php
2 /* vim: set expandtab sw=4 ts=4 sts=4: */
3 /**
4 * URL redirector to avoid leaking Referer with some sensitive information.
6 * @package PhpMyAdmin
7 */
9 /**
10 * Gets core libraries and defines some variables
12 require_once './libraries/common.inc.php';
14 if (! PMA_isValid($_GET['url'])
15 || ! preg_match('/^https?:\/\/[^\n\r]*$/', $_GET['url'])
16 ) {
17 header('Location: ' . $cfg['PmaAbsoluteUri']);
18 } else {
19 header('Location: ' . $_GET['url']);
21 die();