2 /* vim: set expandtab sw=4 ts=4 sts=4: */
4 * URL redirector to avoid leaking Referer with some sensitive information.
8 declare(strict_types
=1);
11 use PhpMyAdmin\Sanitize
;
12 use PhpMyAdmin\Response
;
15 * Gets core libraries and defines some variables
17 define('PMA_MINIMUM_COMMON', true);
18 require_once './libraries/common.inc.php';
20 // Only output the http headers
21 $response = Response
::getInstance();
22 $response->getHeader()->sendHttpHeaders();
25 if (! Core
::isValid($_REQUEST['url'])
26 ||
! preg_match('/^https:\/\/[^\n\r]*$/', $_REQUEST['url'])
27 ||
! Core
::isAllowedDomain($_REQUEST['url'])
29 Core
::sendHeaderLocation('./');
31 // JavaScript redirection is necessary. Because if header() is used
32 // then web browser sometimes does not change the HTTP_REFERER
33 // field and so with old URL as Referer, token also goes to
35 echo "<script type='text/javascript'>
36 window.onload=function(){
37 window.location='" , Sanitize
::escapeJsString($_REQUEST['url']) , "';
40 // Display redirecting msg on screen.
41 // Do not display the value of $_REQUEST['url'] to avoid showing injected content
42 echo __('Taking you to the target site.');