🔒 Prevent open redirects in login and autologin flows

Add erLhcoreClassUserUtils::isValidRedirectPath() to validate user-supplied
redirect paths before issuing Location headers. It rejects absolute URLs,
protocol-relative URLs, control characters, backslashes, and path traversal,
and decodes percent-encoded input multiple times to catch encoded bypasses.

Use this validation in the login and autologin modules whenever a redirect
target is taken from the "r" parameter, so logged-in redirects and post-login
redirects can no longer be hijacked to external sites.

🧼 Also harden form data unserialization by passing allowed_classes => false
to unserialize() when decoding collected form content, preventing object
injection through stored serialized data.

Author: remdex

lhc_web/lib/core/lhuser/lhuserutils.php

@@ -2,6 +2,58 @@
 
 class erLhcoreClassUserUtils
 {
+    /**
+     * Validates redirect path taken from user input (e.g. login "r" parameter).
+     * Ensures the value is a relative path inside the application and can not be used
+     * as an open redirect (absolute URL, protocol relative URL, backslashes, path traversal).
+     *
+     * @param mixed $path
+     * @return bool
+     */
+    public static function isValidRedirectPath($path)
+    {
+        if (!is_string($path) || $path === '') {
+            return false;
+        }
+
+        // Browsers treat %2e%2e%2f as "../", decode a few times before validating
+        for ($i = 0; $i < 3; $i++) {
+            $decoded = rawurldecode($path);
+            if ($decoded === $path) {
+                break;
+            }
+            $path = $decoded;
+        }
+
+        // Control characters, whitespace and backslashes never belong to a valid internal path
+        if (preg_match('/[\x00-\x20\x7F\\\\]/', $path)) {
+            return false;
+        }
+
+        // Absolute URL (http://, javascript:, data:, ...) or protocol relative URL (//host)
+        if (preg_match('#^[^/?\#]*:#', $path) || strpos($path, '//') === 0) {
+            return false;
+        }
+
+        // Path traversal above the base URL
+        $depth = 0;
+        foreach (explode('/', $path) as $segment) {
+            if ($segment === '' || $segment === '.') {
+                continue;
+            }
+
+            if ($segment === '..') {
+                if (--$depth < 0) {
+                    return false;
+                }
+            } else {
+                $depth++;
+            }
+        }
+
+        return true;
+    }
+
     public static function updateStats($userlist)
     {
         $remap = array();

lhc_web/lib/models/lhabstract/erlhabstractmodelformcollected.php

@@ -49,7 +49,7 @@ public function __get($var)
             case 'content_array':
                 $content = json_decode($this->content,true);
                 if ($content === null) {
-                    $content = unserialize($this->content);
+                    $content = unserialize($this->content, array('allowed_classes' => false));
                 }
                 return $this->content_array = $content;
 

lhc_web/modules/lhuser/autologin.php

@@ -31,7 +31,13 @@
     } else {
 
         if ($currentUser->isLogged() && !empty($Params['user_parameters_unordered']['r'])) {
-            header('Location: ' . erLhcoreClassDesign::baseurldirect('site_admin') . '/' . base64_decode(rawurldecode($Params['user_parameters_unordered']['r'])));
+            $redirectPath = base64_decode(rawurldecode($Params['user_parameters_unordered']['r']));
+
+            if (!erLhcoreClassUserUtils::isValidRedirectPath($redirectPath)) {
+                $redirectPath = '';
+            }
+
+            header('Location: ' . erLhcoreClassDesign::baseurldirect('site_admin') . '/' . ltrim($redirectPath, '/'));
             exit;
         }
 
@@ -125,7 +131,10 @@
             ));
 
             erLhcoreClassUser::instance()->setLoggedUser($userToLogin->id);
-            header('Location: ' .erLhcoreClassDesign::baseurldirect('') . $instance->SiteAccess . '/'.ltrim($dataRequest['r'],'/'));
+
+            $redirectPath = isset($dataRequest['r']) && erLhcoreClassUserUtils::isValidRedirectPath($dataRequest['r']) ? $dataRequest['r'] : '';
+
+            header('Location: ' .erLhcoreClassDesign::baseurldirect('') . $instance->SiteAccess . '/'.ltrim($redirectPath,'/'));
             exit;            
         } else {
             die(erTranslationClassLhTranslation::getInstance()->getTranslation('users/autologin','Could not find a provided user'));

lhc_web/modules/lhuser/login.php

@@ -50,7 +50,14 @@
         return;
     } else {
         if ($currentUser->isLogged() && !empty($Params['user_parameters_unordered']['r'])) {
-            header('Location: ' .erLhcoreClassDesign::baseurldirect('site_admin').'/'.base64_decode(rawurldecode($Params['user_parameters_unordered']['r'])));
+            $redirectPath = base64_decode(rawurldecode($Params['user_parameters_unordered']['r']));
+
+            if (erLhcoreClassUserUtils::isValidRedirectPath($redirectPath)) {
+                header('Location: ' .erLhcoreClassDesign::baseurldirect('site_admin').'/'.$redirectPath);
+                exit;
+            }
+
+            header('Location: ' .erLhcoreClassDesign::baseurldirect('site_admin'));
             exit;
         }
 
@@ -62,7 +69,13 @@
     }
 
 } elseif ($currentUser->isLogged() && !empty($Params['user_parameters_unordered']['r'])) {
-    header('Location: ' .erLhcoreClassDesign::baseurldirect('') . $possibleLoginSiteAccess[0] . '/'.base64_decode(rawurldecode($Params['user_parameters_unordered']['r'])));
+    $redirectPath = base64_decode(rawurldecode($Params['user_parameters_unordered']['r']));
+
+    if (!erLhcoreClassUserUtils::isValidRedirectPath($redirectPath)) {
+        $redirectPath = '';
+    }
+
+    header('Location: ' .erLhcoreClassDesign::baseurldirect('') . $possibleLoginSiteAccess[0] . '/'.ltrim($redirectPath,'/'));
     exit;
 }
 
@@ -227,11 +240,16 @@
                 }
 
                 if ($redirect != '') {
-                    erLhcoreClassModule::redirect(base64_decode($redirect));
-                } else {
-                    erLhcoreClassModule::redirect();
-                    exit;
+                    $redirectPath = base64_decode($redirect);
+
+                    if (erLhcoreClassUserUtils::isValidRedirectPath($redirectPath)) {
+                        erLhcoreClassModule::redirect($redirectPath);
+                        exit;
+                    }
                 }
+
+                erLhcoreClassModule::redirect();
+                exit;
             }
         }