Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit b6a29a2

Browse filesBrowse files
committed
bug #24101 [Security] Fix exception when use_referer option is true and referer is not set or empty (linniksa)
This PR was submitted for the master branch but it was merged into the 2.7 branch instead (closes #24101). Discussion ---------- [Security] Fix exception when use_referer option is true and referer is not set or empty | Q | A | ------------- | --- | Branch? | 2.7 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | License | MIT Commits ------- a29e069 [Security] Fix exception when use_referer option is true and referer is not set or empty
2 parents d74144f + a29e069 commit b6a29a2
Copy full SHA for b6a29a2

File tree

2 files changed

+12
-3
lines changed
Filter options

2 files changed

+12
-3
lines changed

‎src/Symfony/Component/Security/Http/Authentication/DefaultAuthenticationSuccessHandler.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Authentication/DefaultAuthenticationSuccessHandler.php
+2-3Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,12 +118,11 @@ protected function determineTargetUrl(Request $request)
118118
return $targetUrl;
119119
}
120120

121-
if ($this->options['use_referer']) {
122-
$targetUrl = $request->headers->get('Referer');
121+
if ($this->options['use_referer'] && $targetUrl = $request->headers->get('Referer')) {
123122
if (false !== $pos = strpos($targetUrl, '?')) {
124123
$targetUrl = substr($targetUrl, 0, $pos);
125124
}
126-
if ($targetUrl !== $this->httpUtils->generateUri($request, $this->options['login_path'])) {
125+
if ($targetUrl && $targetUrl !== $this->httpUtils->generateUri($request, $this->options['login_path'])) {
127126
return $targetUrl;
128127
}
129128
}

‎src/Symfony/Component/Security/Http/Tests/Authentication/DefaultAuthenticationSuccessHandlerTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Tests/Authentication/DefaultAuthenticationSuccessHandlerTest.php
+10Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,16 @@ public function getRequestRedirections()
8383
array(),
8484
'/',
8585
),
86+
'target path as referer when referer not set' => array(
87+
Request::create('/'),
88+
array('use_referer' => true),
89+
'/',
90+
),
91+
'target path as referer when referer is ?' => array(
92+
Request::create('/', 'GET', array(), array(), array(), array('HTTP_REFERER' => '?')),
93+
array('use_referer' => true),
94+
'/',
95+
),
8696
'target path should be different than login URL' => array(
8797
Request::create('/', 'GET', array(), array(), array(), array('HTTP_REFERER' => 'http://localhost/login')),
8898
array('use_referer' => true, 'login_path' => '/login'),

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.