only disallow colons in strings returned by getLangUrl

osma · osma · commit fe9e356489ef · 2022-04-26T14:31:58.000+03:00
diff --git a/model/Request.php b/model/Request.php
@@ -184,8 +184,8 @@ public function getLangUrl($newlang=null)
         if ($newlang !== null) {
             $langurl = preg_replace("#^(.*/)?{$this->lang}/#", "$1{$newlang}/", $langurl);
         }
-        // make sure that the resulting URL doesn't contain suspicious characters
-        $langurl = preg_replace("#[^a-zA-Z0-9/-]#", "", $langurl);
+        // make sure that the resulting URL isn't interpreted as an absolute URL
+        $langurl = str_replace(":", "", $langurl);
         return $langurl;
     }
 
diff --git a/tests/RequestTest.php b/tests/RequestTest.php
@@ -237,7 +237,7 @@ public function testGetLangUrlSanitizeSpecialChars() {
     $this->request->setServerConstant('REQUEST_URI', '/Skosmos/http://example.com');
     $this->request->setLang('en');
     $langurl = $this->request->getLangUrl();
-    $this->assertEquals("http//examplecom", $langurl);
+    $this->assertEquals("http//example.com", $langurl);
   }
 
 }

Original file line number	Diff line number	Diff line change
`@@ -184,8 +184,8 @@ public function getLangUrl($newlang=null)`
`184`	`184`	`if ($newlang !== null) {`
`185`	`185`	`$langurl = preg_replace("#^(.*/)?{$this->lang}/#", "$1{$newlang}/", $langurl);`
`186`	`186`	`}`
`187`		`- // make sure that the resulting URL doesn't contain suspicious characters`
`188`		`- $langurl = preg_replace("#[^a-zA-Z0-9/-]#", "", $langurl);`
	`187`	`+ // make sure that the resulting URL isn't interpreted as an absolute URL`
	`188`	`+ $langurl = str_replace(":", "", $langurl);`
`189`	`189`	`return $langurl;`
`190`	`190`	`}`
`191`	`191`
Original file line number	Diff line number	Diff line change
`@@ -237,7 +237,7 @@ public function testGetLangUrlSanitizeSpecialChars() {`
`237`	`237`	`$this->request->setServerConstant('REQUEST_URI', '/Skosmos/http://example.com');`
`238`	`238`	`$this->request->setLang('en');`
`239`	`239`	`$langurl = $this->request->getLangUrl();`
`240`		`- $this->assertEquals("http//examplecom", $langurl);`
	`240`	`+ $this->assertEquals("http//example.com", $langurl);`
`241`	`241`	`}`
`242`	`242`
`243`	`243`	`}`