Skip to content

Instantly share code, notes, and snippets.

@rissajeanne
Last active November 12, 2021 17:48
Show Gist options
  • Save rissajeanne/7b28c7cc0fd59c2b630ae88b17bc161d to your computer and use it in GitHub Desktop.
Save rissajeanne/7b28c7cc0fd59c2b630ae88b17bc161d to your computer and use it in GitHub Desktop.
Magento 2.4.3 patch for module
--- App/Action/Plugin/Authentication.php.orig
+++ App/Action/Plugin/Authentication.php
@@ -225,10 +225,9 @@
// Checks, whether secret key is required for admin access or request uri is explicitly set
if ($this->_url->useSecretKey()) {
- $requestParts = explode('/', trim($request->getRequestUri(), '/'), 3);
- $baseUrlPath = trim(parse_url($this->backendUrl->getBaseUrl(), PHP_URL_PATH), '/');
- $routeIndex = empty($baseUrlPath) ? 0 : 1;
- $requestUri = $this->_url->getUrl($requestParts[$routeIndex]);
+ // The requested URL has an invalid secret key and therefore redirecting to this URL
+ // will cause a security vulnerability.
+ $requestUri = $this->_url->getUrl($this->_url->getStartupPageUrl());
} elseif ($request) {
$requestUri = $request->getRequestUri();
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment