From 2fcbe2f1dc93a77b10f5c4f28d780e809b8e48c5 Mon Sep 17 00:00:00 2001
From: sparkyx <danydb@noalyss.eu>
Date: Sun, 6 Jul 2025 10:51:27 +0200
Subject: [PATCH] Security : add redirect in javascript and with header

---
 html/do.php                 |  2 +-
 html/export.php             |  2 +-
 html/index.php              |  4 ++--
 html/login.php              | 14 ++++++++------
 html/user_login.php         |  1 -
 include/lib/user_common.php | 22 ++++++++++++++++++++--
 6 files changed, 32 insertions(+), 13 deletions(-)

diff --git a/html/do.php b/html/do.php
index afe5b8fd8..e15a657ca 100644
--- a/html/do.php
+++ b/html/do.php
@@ -41,7 +41,7 @@ mb_internal_encoding("UTF-8");
 // if gDossier is not set redirect to form to choose a folder
 if ( ! isset($_REQUEST['gDossier']))
 {
-    redirect('user_login.php');
+    redirect_header('user_login.php');
     exit();
 }
 if ( ! isset ($_SESSION[SESSION_KEY.'g_user']))
diff --git a/html/export.php b/html/export.php
index b7bfffe5a..df130d472 100644
--- a/html/export.php
+++ b/html/export.php
@@ -55,7 +55,7 @@ $action=$hi->get("act");
 
 if ( $action=='X'  || $g_user->check_print($action)==0 )
   {
-    echo alert(_('Accès interdit'));
+    echo alert(_('Accès interdit'));    
     redirect("do.php?".dossier::get());
     exit();
   }
diff --git a/html/index.php b/html/index.php
index 95015c827..c4b16e631 100644
--- a/html/index.php
+++ b/html/index.php
@@ -135,7 +135,7 @@
  */
 
 
-if (!file_exists('..'.DIRECTORY_SEPARATOR.'include'.DIRECTORY_SEPARATOR.'config.inc.php') )
+if (! file_exists('..'.DIRECTORY_SEPARATOR.'include'.DIRECTORY_SEPARATOR.'config.inc.php') )
 {
     echo <<<EOF
 
@@ -144,7 +144,7 @@ window.location="install.php";
 </script>
 EOF;
 
-    header("Location: install.php", true, 307);
+    header("Location: install.php");
 
     exit(0);
 }
diff --git a/html/login.php b/html/login.php
index 4bea6697a..2e5bccb13 100644
--- a/html/login.php
+++ b/html/login.php
@@ -21,7 +21,6 @@ require_once '../include/constant.php';
 
 require_once NOALYSS_INCLUDE.'/lib/ac_common.php';
 MaintenanceMode("block.html");
-
 /*! \file
  * \brief Login page
  */
@@ -47,7 +46,6 @@ if (  isset ($_POST["p_user"] ) )
     $User=new Noalyss_user($rep);
     $User->Check(false,'LOGIN');
 
-
     /*
      * Check repository version
      */
@@ -69,21 +67,25 @@ if (  isset ($_POST["p_user"] ) )
           if ( $valid == false )
           {
           echo alert(_('Code invalide'));
-          echo "<META HTTP-EQUIV=\"REFRESH\" content=\"0;url=index.php\">";
+          
+          header("Location: ".NOALYSS_URL."/index.php");
           exit();
         }
       }
       if ($User->get_access_mode()=='PC')
       {
         // force the nocache
-        $backurl='user_login.php?v='.microtime(true);
+        $backurl=NOALYSS_URL.'/user_login.php?v='.microtime(true);
         if ( isset ($_POST['backurl'])) {
               $backurl=urldecode($_POST['backurl']);
+              // check that backurl is valid
+              $backurl=preg_replace('/^.*\?/','',$backurl);
+              $backurl=NOALYSS_URL."?$backurl";
           }
-        echo "<META HTTP-EQUIV=\"REFRESH\" content=\"0;url={$backurl}\">";
+        header("Location: $backurl");
         exit();
       } else {
-           echo "<META HTTP-EQUIV=\"REFRESH\" content=\"0;url=mobile.php\">";
+           header("Location: ".NOALYSS_URL."/mobile.php");
            exit();
       }
 }
diff --git a/html/user_login.php b/html/user_login.php
index cf3c33aae..f2317cd95 100644
--- a/html/user_login.php
+++ b/html/user_login.php
@@ -28,7 +28,6 @@ require_once NOALYSS_INCLUDE.'/lib/itext.class.php';
 require_once NOALYSS_INCLUDE.'/lib/http_input.class.php';
 require_once NOALYSS_INCLUDE.'/lib/function_javascript.php';
 require_once NOALYSS_INCLUDE.'/lib/icon_action.class.php';
-
 @html_page_start($_SESSION[SESSION_KEY.'g_theme']);
 MaintenanceMode("block.html");
 
diff --git a/include/lib/user_common.php b/include/lib/user_common.php
index 151c8d709..bb54de579 100644
--- a/include/lib/user_common.php
+++ b/include/lib/user_common.php
@@ -178,12 +178,30 @@ function CleanUrl()
     $url=http_build_query($_GET);
     return $url;
 }
-function redirect($p_string,$p_time=0)
+/**
+ * @brief redirect with javascript
+ * @param $p_string (string) URL
+ * @param $p_time (type ) time before redirecting
+ */
+function redirect( $p_string,$p_time=0) 
+{
+    if (strpos( $p_string,'?') == 0 ) {
+         $p_string = $p_string.'?v='.microtime(true);
+     }
+    echo '<HTML><head><META HTTP-EQUIV="REFRESH" content="'.$p_time.'; url='.$p_string.'"></head><body> Connecting... </body></html>';
+}
+/**
+ * @brief redirect with header, 
+ * @note if something has been already send to the browser, 
+ * the redirection will fails
+ * @param string $p_string
+ */
+function redirect_header($p_string)
 {
     if (strpos( $p_string,'?') == 0 ) {
         $p_string = $p_string.'?v='.microtime(true);
     }
-    echo '<HTML><head><META HTTP-EQUIV="REFRESH" content="'.$p_time.'; url='.$p_string.'"></head><body> Connecting... </body></html>';
+    header("Location: $p_string");
 }
 /*!
  * \brief remove the useless space, change comma by period and try to return