url.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * URL redirector to avoid leaking Referer with some sensitive information.
   5  *
   6  * @package PhpMyAdmin
   7  */
   8
   9 /**
  10  * Gets core libraries and defines some variables
  11  */
  12 define('PMA_MINIMUM_COMMON', true);
  13 require_once './libraries/common.inc.php';
  14
  15 if (! PMA_isValid($_GET['url'])
  16     || ! preg_match('/^https?:\/\/[^\n\r]*$/', $_GET['url'])
  17     || ! PMA_isAllowedDomain($_GET['url'])
  18 ) {
  19     header('Location: ' . $cfg['PmaAbsoluteUri']);
  20 } else {
  21     // JavaScript redirection is necessary. Because if header() is used
  22     //  then web browser sometimes does not change the HTTP_REFERER
  23     //  field and so with old URL as Referer, token also goes to
  24     //  external site.
  25     echo "<script type='text/javascript'>
  26             window.onload=function(){
  27                 window.location='" . htmlspecialchars($_GET['url']) . "';
  28             }
  29         </script>";
  30     // Display redirecting msg on screen.
  31     printf(__('Taking you to %s.'), htmlspecialchars($_GET['url']));
  32 }
  33 die();
  34 ?>