Some improvements:

[mailer.git] / inc / modules / loader.php

diff --git a/inc/modules/loader.php b/inc/modules/loader.php
index 294abf4d8378cc648e75c5e468b277f433d4626d..e154a9395b23bb9a815e37247502dd697fc87871 100644 (file)
--- a/inc/modules/loader.php
+++ b/inc/modules/loader.php
@@ -41,19 +41,40 @@ if (!defined('__SECURITY')) {
 } // END - if
 
 // Is an URL specified?
-if (isGetRequestElementSet('url')) {
+if ((isGetRequestElementSet('url')) && (isGetRequestElementSet('hash')) && (isGetRequestElementSet('salt'))) {
        // Decode URL
-       $url = decodeString(str_replace(' ', '+', compileUriCode(urldecode(getRequestElement('url')))));
+       $decodedUrl = decodeString(str_replace(' ', '+', compileUriCode(urldecode(getRequestElement('url')))));
 
-       // Validate the URL
-       if (isUrlValid($url)) {
+       // Debug message
+       //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'decodedUrl=' . $decodedUrl . ',hash=' . getRequestElement('hash'));
+
+       // Generate hash for comparing it
+       $hash = encodeHashForCookie(generateHash($decodedUrl . getSiteKey() . getDateKey(), getRequestElement('salt')));
+
+       // Debug message
+       //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'decodedUrl=' . $decodedUrl . ',hash=' . $hash);
+
+       // Validate the URL and hash
+       if ($hash != getRequestElement('hash')) {
+               // Hash doesn't match
+               displayMessage('{--LOADER_SECURITY_HASH_MISMATCH--}');
+
+               // Log this event
+               logDebugMessage(__FILE__, __LINE__, 'Hash ' . getRequestElement('hash') . ' does not match URL ' . $decodedUrl);
+       } elseif (isUrlValid($decodedUrl)) {
                // Generate a JavaScript that redirects us
-               loadTemplate('loader', false, $url);
+               loadTemplate('loader', FALSE, $decodedUrl);
        } else {
                // URL invalid
                redirectToUrl('modules.php?module=index');
        }
 } else {
+       // Is the hash not provided?
+       if (!isGetRequestElementSet('hash')) {
+               // Very old (external!) call
+               logDebugMessage(__FUNCTION__, __LINE__, 'Possible old call on loader.php detected. Redirecting to index.php anyway ...');
+       } // END - if
+
        // Invalid or no URL entered!
        redirectToUrl('modules.php?module=index');
 }