url.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * URL redirector to avoid leaking Referer with some sensitive information.
   5  *
   6  * @package PhpMyAdmin
   7  */
   8 declare(strict_types=1);
   9
  10 use PhpMyAdmin\Core;
  11 use PhpMyAdmin\Sanitize;
  12 use PhpMyAdmin\Response;
  13
  14 if (! defined('ROOT_PATH')) {
  15     define('ROOT_PATH', __DIR__ . DIRECTORY_SEPARATOR);
  16 }
  17
  18 /**
  19  * Gets core libraries and defines some variables
  20  */
  21 define('PMA_MINIMUM_COMMON', true);
  22 require_once ROOT_PATH . 'libraries/common.inc.php';
  23
  24 // Only output the http headers
  25 $response = Response::getInstance();
  26 $response->getHeader()->sendHttpHeaders();
  27 $response->disable();
  28
  29 if (! Core::isValid($_GET['url'])
  30     || ! preg_match('/^https:\/\/[^\n\r]*$/', $_GET['url'])
  31     || ! Core::isAllowedDomain($_GET['url'])
  32 ) {
  33     Core::sendHeaderLocation('./');
  34 } else {
  35     // JavaScript redirection is necessary. Because if header() is used
  36     //  then web browser sometimes does not change the HTTP_REFERER
  37     //  field and so with old URL as Referer, token also goes to
  38     //  external site.
  39     echo "<script type='text/javascript'>
  40             window.onload=function(){
  41                 window.location='" , Sanitize::escapeJsString($_GET['url']) , "';
  42             }
  43         </script>";
  44     // Display redirecting msg on screen.
  45     // Do not display the value of $_GET['url'] to avoid showing injected content
  46     echo __('Taking you to the target site.');
  47 }
  48 die();