aboutsummaryrefslogtreecommitdiffstats
path: root/config
diff options
context:
space:
mode:
authorRenato Botelho <garga@FreeBSD.org>2014-06-21 11:15:29 -0300
committerRenato Botelho <garga@FreeBSD.org>2014-06-21 11:15:29 -0300
commit79de69da2668af481a1d11b8ec6e2a6c340190cc (patch)
treee917567db1903529cad47fb6a6cd1966ab8dccad /config
parent96ea5d31f1249839ab02d19a9a1f836a018c6998 (diff)
downloadpfsense-packages-79de69da2668af481a1d11b8ec6e2a6c340190cc.tar.gz
pfsense-packages-79de69da2668af481a1d11b8ec6e2a6c340190cc.tar.bz2
pfsense-packages-79de69da2668af481a1d11b8ec6e2a6c340190cc.zip
Make sure referer uses local host to avoid sending users to ext sites.
Diffstat (limited to 'config')
-rw-r--r--config/suricata/suricata_rules_flowbits.php2
1 files changed, 1 insertions, 1 deletions
diff --git a/config/suricata/suricata_rules_flowbits.php b/config/suricata/suricata_rules_flowbits.php
index f266875c..8d0fd5d3 100644
--- a/config/suricata/suricata_rules_flowbits.php
+++ b/config/suricata/suricata_rules_flowbits.php
@@ -65,7 +65,7 @@ if (is_null($id)) {
// Set who called us so we can return to the correct page with
// the RETURN ('cancel') button.
-if ($_POST['referrer'] && substr($_POST['referrer'], 0, 1) == '/')
+if (isset($_POST['referrer']) && strpos($_POST['referrer'], '://'.$_SERVER['SERVER_NAME'].'/') !== FALSE)
$referrer = $_POST['referrer'];
else
$referrer = $_SERVER['HTTP_REFERER'];