Attempt to redirect to a potentially insecure URL

tweety · PR0 Joined: 24 Jan 2007 Posts: 94

I have identified a error with phpbb_seo_class.php and some returning urls

i am testing a return url from a shop linked to a site. once customer has purchased there is a return to site link.

this returns to site url and says thank you for buying. it was all working and still does except that now this comes up

SeO

Well, the warning is here for something, you really should not redirection an insecure way.
The message shows up either because there is a "\n", "\r" (new line) or a ";url" in the url sent to the seo_redirect method.

Now this being said, I do not really see how this method could be used in the case you mention. The same checks are being performed in the regular phpBB redirect() function, so it could come from there too.

In all cases, you should find a way to clean out your return url and make sure it is 1) valid, and 2) does not contain these forbidden terms.

tweety · PR0 Joined: 24 Jan 2007 Posts: 94

this return url is from paypal and must be part of clients site.

so if code can not be adapted, bad news because of course i can not access paypal return coding. it will now be big problem for me to think about. maybe i need to lose seo on some parts

do you have any hope of how i can change the code to accept such url as paypal do.

here is sample of course not real but similar of what will be each time slight change

dcz

I need to understand a bit more things here.

so this is the link that leads to paypal, and Return+to+MYSITE in there stands for your return url ?

The thing is you should not go through any of the two functions using the checks we are talking about in the procedure (seo_redirect() and redirect()).

++

tweety · PR0 Joined: 24 Jan 2007 Posts: 94

no this link comes from paypal, it is a standard return to seller site link. that is offered after a payment has been made from a pay pal button on a website.
I have no control over that url. it comes from paypal.

thank you for trying to help, please ask more questions as you need me to answer for getting help on this.

dcz

What I do not understand is why this url would go through seo_redirect() and / or redirect(), since it does not concern phpBB in the first place (thanks.php).

Is it a mod or something ? Could you post some sample code to understand better the process used ?

++