X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=inc%2Fmodules%2Floader.php;h=5e5bd89ed8a02f7706f917af2766a28fe1d965d6;hb=155492a5b96cec674846973a8524238b0365a848;hp=e31841f540216762f1ace4f313eee289bf9a8e51;hpb=c8d76610eb94093d4eed4fcd8a6cb72e74c8f6d8;p=mailer.git

diff --git a/inc/modules/loader.php b/inc/modules/loader.php
index e31841f540..5e5bd89ed8 100644
--- a/inc/modules/loader.php
+++ b/inc/modules/loader.php
@@ -16,8 +16,8 @@
  * $Author::                                                          $ *
  * -------------------------------------------------------------------- *
  * Copyright (c) 2003 - 2009 by Roland Haeder                           *
- * Copyright (c) 2009, 2010 by Mailer Developer Team                    *
- * For more information visit: http://www.mxchange.org                  *
+ * Copyright (c) 2009 - 2013 by Mailer Developer Team                   *
+ * For more information visit: http://mxchange.org                      *
  *                                                                      *
  * This program is free software; you can redistribute it and/or modify *
  * it under the terms of the GNU General Public License as published by *
@@ -37,23 +37,44 @@
 
 // Some security stuff...
 if (!defined('__SECURITY')) {
-	die();
+	exit();
 } // END - if
 
 // Is an URL specified?
-if (isGetRequestParameterSet('url')) {
+if ((isGetRequestElementSet('url')) && (isGetRequestElementSet('hash')) && (isGetRequestElementSet('salt'))) {
 	// Decode URL
-	$url = decodeString(str_replace(' ', '+', compileUriCode(urldecode(getRequestParameter('url')))));
+	$decodedUrl = decodeString(str_replace(' ', '+', compileUriCode(urldecode(getRequestElement('url')))));
 
-	// Validate the URL
-	if (isUrlValid($url)) {
+	// Debug message
+	//* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'decodedUrl=' . $decodedUrl . ',hash=' . getRequestElement('hash'));
+
+	// Generate hash for comparing it
+	$hash = encodeHashForCookie(generateHash($decodedUrl . getSiteKey() . getDateKey(), getRequestElement('salt')));
+
+	// Debug message
+	//* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'decodedUrl=' . $decodedUrl . ',hash=' . $hash);
+
+	// Validate the URL and hash
+	if ($hash != getRequestElement('hash')) {
+		// Hash doesn't match
+		displayMessage('{--LOADER_SECURITY_HASH_MISMATCH--}');
+
+		// Log this event
+		logDebugMessage(__FILE__, __LINE__, 'Hash ' . getRequestElement('hash') . ' does not match URL ' . $decodedUrl);
+	} elseif (isUrlValid($decodedUrl)) {
 		// Generate a JavaScript that redirects us
-		loadTemplate('loader', false, $url);
+		loadTemplate('loader', FALSE, $decodedUrl);
 	} else {
 		// URL invalid
 		redirectToUrl('modules.php?module=index');
 	}
 } else {
+	// Is the hash not provided?
+	if (!isGetRequestElementSet('hash')) {
+		// Very old (external!) call
+		logDebugMessage(__FUNCTION__, __LINE__, 'Possible old call on loader.php detected. Redirecting to index.php anyway ...');
+	} // END - if
+
 	// Invalid or no URL entered!
 	redirectToUrl('modules.php?module=index');
 }