adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

identification should redirect within Piwigo only #653

New Issue
Closed
opened 2026-10-05 00:09:22 +02:00 by adam · 3 comments
adam commented 2026-10-05 00:09:22 +02:00
Owner
Copy link
Copy source

The $_POST['redirect'] system in identification.php can lead to redirect outside Piwigo. On any location actually. To avoid any "open redirect" security issue, Piwigo should make sure the redirection occurs only with Piwigo, not outside.

Reported by Eric Fernando Castañeda Nazario

The `$_POST['redirect']` system in identification.php can lead to redirect outside Piwigo. On any location actually. To avoid any "open redirect" security issue, Piwigo should make sure the redirection occurs only with Piwigo, not outside. Reported by Eric Fernando Castañeda Nazario <!-- github-sync-id:235796803 -->
adam closed this issue 2026-10-05 00:09:22 +02:00
adam commented 2026-10-05 00:09:23 +02:00
Author
Owner
Copy link
Copy source

@modus75 can you review that please :-) ?

For the "forced redirection" (second commit bbb9c5e6b5), here are 4 examples:

A) http://localhost/piwigo/git/identification.php?redirect=/piwigo/git/admin.php

{redirect (raw) = /piwigo/git/admin.php}
{get_absolute_root_url = http://localhost/piwigo/git/}
{cookie_path = /piwigo/git/}
{host = http://localhost}
{redirect (final) = http://localhost/piwigo/git/admin.php}

B) http://localhost/piwigo/git/identification.php?redirect=http://piwigo.org

{redirect (raw) = http://piwigo.org}
{get_absolute_root_url = http://localhost/piwigo/git/}
{cookie_path = /piwigo/git/}
{host = http://localhost}
{redirect (final) = http://localhosthttp://piwigo.org} => that will fail

C) https://pierrick.piwigo.com/identification.php?redirect=%252Fadmin.php

{redirect (raw) = /admin.php}
{get_absolute_root_url = https://pierrick.piwigo.com/}
{cookie_path = /}
{host = https://pierrick.piwigo.com}
{redirect (final) = https://pierrick.piwigo.com/admin.php}

D) https://pierrick.piwigo.com/identification.php?redirect=http://piwigo.org

{redirect (raw) = http://piwigo.org}
{get_absolute_root_url = https://pierrick.piwigo.com/}
{cookie_path = /}
{host = https://pierrick.piwigo.com}
{redirect (final) = https://pierrick.piwigo.comhttp://piwigo.org} => that will fail too
@modus75 can you review that please :-) ? For the "forced redirection" (second commit bbb9c5e6b5bb44ad231050f6fb9f624a4925c5f8), here are 4 examples: A) http://localhost/piwigo/git/identification.php?redirect=/piwigo/git/admin.php ``` {redirect (raw) = /piwigo/git/admin.php} {get_absolute_root_url = http://localhost/piwigo/git/} {cookie_path = /piwigo/git/} {host = http://localhost} {redirect (final) = http://localhost/piwigo/git/admin.php} ``` B) http://localhost/piwigo/git/identification.php?redirect=http://piwigo.org ``` {redirect (raw) = http://piwigo.org} {get_absolute_root_url = http://localhost/piwigo/git/} {cookie_path = /piwigo/git/} {host = http://localhost} {redirect (final) = http://localhosthttp://piwigo.org} => that will fail ``` C) https://pierrick.piwigo.com/identification.php?redirect=%252Fadmin.php ``` {redirect (raw) = /admin.php} {get_absolute_root_url = https://pierrick.piwigo.com/} {cookie_path = /} {host = https://pierrick.piwigo.com} {redirect (final) = https://pierrick.piwigo.com/admin.php} ``` D) https://pierrick.piwigo.com/identification.php?redirect=http://piwigo.org ``` {redirect (raw) = http://piwigo.org} {get_absolute_root_url = https://pierrick.piwigo.com/} {cookie_path = /} {host = https://pierrick.piwigo.com} {redirect (final) = https://pierrick.piwigo.comhttp://piwigo.org} => that will fail too ``` <!-- github-comment-id:308360425 -->
adam commented 2026-10-05 00:09:24 +02:00
Author
Owner
Copy link
Copy source

Looks OK to me

Le 14 juin 2017 10:28, "Pierrick Le Gall" notifications@github.com a
écrit :

@modus75 https://github.com/modus75 can you review that?

For the "forced redirection" (second commit bbb9c5e
https://github.com/Piwigo/Piwigo/commit/bbb9c5e6b5bb44ad231050f6fb9f624a4925c5f8),
here are 4 examples:

A) http://localhost/piwigo/git/identification.php?redirect=/
piwigo/git/admin.php

{redirect (raw) = /piwigo/git/admin.php}
{get_absolute_root_url = http://localhost/piwigo/git/}
{cookie_path = /piwigo/git/}
{host = http://localhost}
{redirect (final) = http://localhost/piwigo/git/admin.php}

B) http://localhost/piwigo/git/identification.php?redirect=
http://piwigo.org

{redirect (raw) = http://piwigo.org}
{get_absolute_root_url = http://localhost/piwigo/git/}
{cookie_path = /piwigo/git/}
{host = http://localhost}
{redirect (final) = http://localhosthttp://piwigo.org} => that will fail

C) https://pierrick.piwigo.com/identification.php?redirect=%252Fadmin.php

{redirect (raw) = /admin.php}
{get_absolute_root_url = https://pierrick.piwigo.com/}
{cookie_path = /}
{host = https://pierrick.piwigo.com}
{redirect (final) = https://pierrick.piwigo.com/admin.php}

D) https://pierrick.piwigo.com/identification.php?redirect=
http://piwigo.org

{redirect (raw) = http://piwigo.org}
{get_absolute_root_url = https://pierrick.piwigo.com/}
{cookie_path = /}
{host = https://pierrick.piwigo.com}
{redirect (final) = https://pierrick.piwigo.comhttp://piwigo.org} => that will fail too

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/Piwigo/Piwigo/issues/706#issuecomment-308360425, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AJRc9vKeV51fXSppF1N8Y8q8UUG2lJGyks5sD5mlgaJpZM4N5h80
.

Looks OK to me Le 14 juin 2017 10:28, "Pierrick Le Gall" <notifications@github.com> a écrit : > @modus75 <https://github.com/modus75> can you review that? > > For the "forced redirection" (second commit bbb9c5e > <https://github.com/Piwigo/Piwigo/commit/bbb9c5e6b5bb44ad231050f6fb9f624a4925c5f8>), > here are 4 examples: > > A) http://localhost/piwigo/git/identification.php?redirect=/ > piwigo/git/admin.php > > {redirect (raw) = /piwigo/git/admin.php} > {get_absolute_root_url = http://localhost/piwigo/git/} > {cookie_path = /piwigo/git/} > {host = http://localhost} > {redirect (final) = http://localhost/piwigo/git/admin.php} > > B) http://localhost/piwigo/git/identification.php?redirect= > http://piwigo.org > > {redirect (raw) = http://piwigo.org} > {get_absolute_root_url = http://localhost/piwigo/git/} > {cookie_path = /piwigo/git/} > {host = http://localhost} > {redirect (final) = http://localhosthttp://piwigo.org} => that will fail > > C) https://pierrick.piwigo.com/identification.php?redirect=%252Fadmin.php > > {redirect (raw) = /admin.php} > {get_absolute_root_url = https://pierrick.piwigo.com/} > {cookie_path = /} > {host = https://pierrick.piwigo.com} > {redirect (final) = https://pierrick.piwigo.com/admin.php} > > D) https://pierrick.piwigo.com/identification.php?redirect= > http://piwigo.org > > {redirect (raw) = http://piwigo.org} > {get_absolute_root_url = https://pierrick.piwigo.com/} > {cookie_path = /} > {host = https://pierrick.piwigo.com} > {redirect (final) = https://pierrick.piwigo.comhttp://piwigo.org} => that will fail too > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub > <https://github.com/Piwigo/Piwigo/issues/706#issuecomment-308360425>, or mute > the thread > <https://github.com/notifications/unsubscribe-auth/AJRc9vKeV51fXSppF1N8Y8q8UUG2lJGyks5sD5mlgaJpZM4N5h80> > . > <!-- github-comment-id:308452684 -->
adam commented 2026-10-05 00:09:24 +02:00
Author
Owner
Copy link
Copy source

Thank you @modus75 commits merged :-)

Thank you @modus75 commits merged :-) <!-- github-comment-id:308496023 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#653