From a0b230fa46b7d063690cf80872efdd26ae401f8a Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sat, 19 Sep 2020 01:58:46 +0200 Subject: [PATCH] Fix #yogosha4534 --- htdocs/core/lib/functions.lib.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 5eb9d142c0c..51fb7ef62ea 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -606,9 +606,9 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null break; } - // Sanitizing for special var name. There is no reason to allow a backtopage to an external URL. + // Sanitizing for special parameters. There is no reason to allow the backtopage parameter to contains an external URL. if ($paramname == 'backtopage') { - $out = preg_replace(array('/\/\/+/', '/^[a-z]*:/'), '', $out); + $out = preg_replace(array('/[\\\/][\\\/]+/', '/^[a-z]*:/'), '', $out); } // Code for search criteria persistence.