Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Fix #yogosha4534

Browse Source
This commit is contained in:
Laurent Destailleur
2020-09-19 01:58:46 +02:00
parent 6a45545ec1
commit a0b230fa46
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/core/lib/functions.lib.php
View File

@@ -606,9 +606,9 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null
break; break;
} }
// Sanitizing for special var name. There is no reason to allow a backtopage to an external URL. // Sanitizing for special parameters. There is no reason to allow the backtopage parameter to contains an external URL.
if ($paramname == 'backtopage') { if ($paramname == 'backtopage') {
$out = preg_replace(array('/\/\/+/', '/^[a-z]*:/'), '', $out); $out = preg_replace(array('/[\\\/][\\\/]+/', '/^[a-z]*:/'), '', $out);
} }
// Code for search criteria persistence. // Code for search criteria persistence.