Uploaded image for project: 'phpBB3'
  1. phpBB3
  2. PHPBB3-16966

"Insecure redirect" error while permanently deleting posts

    XMLWordPrintable

Details

    Description

      When trying to delete post permanently, "Insecure redirect" error occurs if redirect link contains #p anchor.

      That is because of https://github.com/phpbb/phpbb/blob/c9db94f91cd4e682c8c2fc2d768eab52042d5ec7/phpBB/includes/mcp/mcp_main.php#L1248 condition which has an issue with parentheses that causes calling function substr() with a bool 3rd argument: $redirect = substr($redirect, 0, $anchor_pos);

      After this, $redirect link becomes a dot from for example ./viewtopic.php?t=1&p=3#p3 link.

      Attachments

        Activity

          People

            Marc Marc
            rxu rxu
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: