AfRA/AfRApay
3
0
Fork 0
Code Issues 7 Pull requests Packages Projects Releases Wiki Activity

Fix open redirect

Browse source
This commit is contained in:
Laura Hausmann 2023-02-16 16:36:26 +01:00
parent 3848a2fec5
commit 4e03ed1ea4
Signed by: zotan
GPG key ID: D044E84C5BE01605
3 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
AfRApay.Web/Pages/EditUser.cshtml.cs
View file

@ -63,7 +63,7 @@ public class EditUserModel : PageModel {
if (Request.Form["action"] == "save" && Request.Form.ContainsKey("nickname") && !string.IsNullOrWhiteSpace(Request.Form["nickname"])) {
var nick = Request.Form["nickname"].ToString();
if (db.Users.Any(p => p.Nickname == nick && p.Id != userId)) {
Response.Redirect($"/ErrorRedirect?redir=/EditUser/{userId}&message=" + WebUtility.UrlEncode("User with nick already exists."));
Response.Redirect($"/ErrorRedirect?redir=EditUser/{userId}&message=" + WebUtility.UrlEncode("User with nick already exists."));
return;
}

3
AfRApay.Web/Pages/ErrorRedirect.cshtml
View file

@ -1,10 +1,11 @@
@page
@{
ViewData["Title"] = "Error";
var target = "/" + Request.Query["redir"];
}
@section Header {
<meta http-equiv="refresh" content="5;@(Request.Query.ContainsKey("redir") ? Request.Query["redir"] : "/")"/>
<meta http-equiv="refresh" content="5;@target"/>
}
<div class="alert alert-danger" role="alert">
@Request.Query["message"]

4
AfRApay.Web/Pages/Index.cshtml.cs
View file

@ -32,7 +32,7 @@ public class IndexModel : PageModel {
if (Request.Form.ContainsKey("nickname") && !string.IsNullOrWhiteSpace(Request.Form["nickname"])) {
var nick = Request.Form["nickname"];
if (db.Users.Any(p => p.Nickname == nick.ToString())) {
Response.Redirect("/ErrorRedirect?redir=/%23add_user&message=" + WebUtility.UrlEncode("User with nick already exists."));
Response.Redirect("/ErrorRedirect?redir=%23add_user&message=" + WebUtility.UrlEncode("User with nick already exists."));
return;
}
@ -43,7 +43,7 @@ public class IndexModel : PageModel {
return;
}
Response.Redirect("/ErrorRedirect?redir=/%23add_user&message=" + WebUtility.UrlEncode("Nickname must not be empty."));
Response.Redirect("/ErrorRedirect?redir=%23add_user&message=" + WebUtility.UrlEncode("Nickname must not be empty."));
}
else {
Response.Redirect("/");