X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=inc%2Fmodules%2Floader.php;h=2216d8ac012dd843c40fa5eeeb68f1471291504d;hb=e19231f39d9d6583cc5753dbd2638c597957fdd1;hp=96e1bc8a3ae42ef25b01957d47026bad6b1f432a;hpb=60494e212a67fe360bfbb481eb4928480a6f379b;p=mailer.git

diff --git a/inc/modules/loader.php b/inc/modules/loader.php
index 96e1bc8a3a..2216d8ac01 100644
--- a/inc/modules/loader.php
+++ b/inc/modules/loader.php
@@ -1,7 +1,7 @@
 <?php
 /************************************************************************
- * MXChange v0.2.1                                    Start: 10/29/2003 *
- * ===============                              Last change: 04/17/2004 *
+ * Mailer v0.2.1-FINAL                                Start: 10/29/2003 *
+ * ===================                          Last change: 04/17/2004 *
  *                                                                      *
  * -------------------------------------------------------------------- *
  * File              : loader.php                                       *
@@ -10,10 +10,14 @@
  * -------------------------------------------------------------------- *
  * Kurzbeschreibung  : Referrer neu setzen                              *
  * -------------------------------------------------------------------- *
- *                                                                      *
+ * $Revision::                                                        $ *
+ * $Date::                                                            $ *
+ * $Tag:: 0.2.1-FINAL                                                 $ *
+ * $Author::                                                          $ *
  * -------------------------------------------------------------------- *
- * Copyright (c) 2003 - 2008 by Roland Haeder                           *
- * For more information visit: http://www.mxchange.org                  *
+ * Copyright (c) 2003 - 2009 by Roland Haeder                           *
+ * Copyright (c) 2009 - 2016 by Mailer Developer Team                   *
+ * For more information visit: http://mxchange.org                      *
  *                                                                      *
  * This program is free software; you can redistribute it and/or modify *
  * it under the terms of the GNU General Public License as published by *
@@ -32,33 +36,48 @@
  ************************************************************************/
 
 // Some security stuff...
-if (ereg(basename(__FILE__), $_SERVER['PHP_SELF']))
-{
-	$INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php";
-	require($INC);
-}
+if (!defined('__SECURITY')) {
+	exit();
+} // END - if
+
+// Is an URL specified?
+if ((isGetRequestElementSet('url')) && (isGetRequestElementSet('hash')) && (isGetRequestElementSet('salt'))) {
+	// Decode URL
+	$decodedUrl = decodeString(str_replace(' ', '+', compileUriCode(urldecode(getRequestElement('url')))));
+
+	// Debug message
+	//* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'decodedUrl=' . $decodedUrl . ',hash=' . getRequestElement('hash'));
+
+	// Generate hash for comparing it
+	$hash = encodeHashForCookie(generateHash($decodedUrl . getSiteKey() . getDateKey(), getRequestElement('salt')));
 
-if (!empty($_GET['url']))
-{
-	$url = base64_decode(urldecode(COMPILE_CODE($_GET['url'])));
-	if (VALIDATE_URL($url))
-	{
-		// Prepare data for the template
-		define('__URL', $url);
+	// Debug message
+	//* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'decodedUrl=' . $decodedUrl . ',hash=' . $hash);
 
+	// Validate the URL and hash
+	if ($hash != getRequestElement('hash')) {
+		// Hash doesn't match
+		displayMessage('{--LOADER_SECURITY_HASH_MISMATCH--}');
+
+		// Log this event
+		logDebugMessage(__FILE__, __LINE__, 'Hash ' . getRequestElement('hash') . ' does not match URL ' . $decodedUrl);
+	} elseif (isUrlValid($decodedUrl)) {
 		// Generate a JavaScript that redirects us
-		LOAD_TEMPLATE("loader");
-	}
-	 else
-	{
+		loadTemplate('loader', FALSE, $decodedUrl);
+	} else {
 		// URL invalid
-		LOAD_URL("index.php");
+		redirectToUrl('modules.php?module=index');
 	}
-}
- else
-{
+} else {
+	// Is the hash not provided?
+	if (!isGetRequestElementSet('hash')) {
+		// Very old (external!) call
+		logDebugMessage(__FUNCTION__, __LINE__, 'Possible old call on loader.php detected. Redirecting to index.php anyway ...');
+	} // END - if
+
 	// Invalid or no URL entered!
-	LOAD_URL("index.php");
+	redirectToUrl('modules.php?module=index');
 }
-//
+
+// [EOF]
 ?>