External urls on this page break since we took out the base tag. (ugh for that).

This patch fixes that.

And an passant fixes a potential security issue too: I could fake referrers and thus inject ugly XSS urls in the tracker pages. Because of that, I set this to "critical".

Comments

Bèr Kessels’s picture

Version: 4.6.5 » x.y.z
Steven’s picture

This is impossible: l() always calls check_url() on the $path after it is passed through url(). Something very fishy is going on. Most likely url() is not seeing the referrer as an external URL.

markus_petrux’s picture

I believe the problem is this line in function url():

if (strpos($path, ':') !== FALSE && filter_xss_bad_protocol($path) == $path) {

For referrers (or any other full url), the first condition (searching for ':') would be true, but the second condition would fail if there are, for instance, ampersands (common in many referrers, specially those coming from search engines).

markus_petrux’s picture

Status: Active » Needs work

Chaging the status because the patch won't work for the reason described by Steven.

morbus iff’s picture

I'm not sure we should be passing full external URLs to l() or url() anyways - their docs and code suggest they only care about internal URLs, aliases, and paths. That seems to be the brunt of the problem - it's fiddling too much with something it shouldn't be fiddling with.

chx’s picture

then the docs is out of date. l and url now does external.

morbus iff’s picture

admin/logs/referrers continues to work for me, on external links, with GET params. This means one of two things. Either '<a href="'. check_url($referrer->url) .'">' is the right answer for this bug, or admin/logs/referrers is doing something wrong.

morbus iff’s picture

Incidentally, how does removing BASE break external URLs? Yes, this is a bug, but I fail to
see how BASE would have any effect whatsoever on URL encoding in url() or l().

drewish’s picture

dopry’s picture

bump... so did anyone figure out what was going on here? does ber's patch work or not?
Is this even a valid bug? Can anyone who's using statistics reproduce?

Bèr Kessels’s picture

Assigned: Unassigned » Bèr Kessels
Status: Needs work » Needs review

This patch makes the node tracker similar to teh default tracker: with a hardcoded A tag (yuk!).
* Its more consistent
* It seems the shortest way to a solution (as opposed to rewriting the check_url bits and pieces)

Bèr

Bèr Kessels’s picture

but I did have my coffee.. really!

morbus iff’s picture

Status: Needs review » Reviewed & tested by the community

This is the way I would do it too - the proper fix is faar too convoluted, IMO, for 4.7, and involves rewriting the internals of url() to check for GET parameters in the $path (when it expects those in $query). The current patch makes the behavior the same as on admin/logs/referrers (see also comment #7). Setting RTBC - once committed, we should reset this to active, so that we remember to work on url() for 4.8 with stronger absolute URL support, and static files (such that you can create .css and image links without having ?q= appended).

markus_petrux’s picture

Status: Reviewed & tested by the community » Needs work

IMHO, code needs work, reasons:

1) the patch has removed the column width check.
2) the referrer is render in other places, each with its own method. lack of consistency.

I'll try to roll a patch that fixes those issues.

morbus iff’s picture

Erm. The column width checker is still there, and the referrer is now using the same approach as admin/logs/referrers. What exactly are you working on?

morbus iff’s picture

Status: Needs work » Reviewed & tested by the community
markus_petrux’s picture

Status: Reviewed & tested by the community » Needs review
StatusFileSize
new2.38 KB

Morbus, you're right. The width check is present in the patch. I was confused because it isn't present in another place where the referrer is printed.

I have created a wrapper function, so the referrer is printed the same way everywhere. Feel free to discard, if the approach is not correct.

morbus iff’s picture

I'm fine with this approach. Berkes?

Bèr Kessels’s picture

what is that return '&nbsp;'; good for?

dries’s picture

Sometimes we do want to show the complete URL. Sometimes (in table views) we only want to show part of the URL.
Making all code use the width check is not advised imo.

dopry’s picture

+1 for Ber's last patch... it fixes the problem...

morbus iff’s picture

Status: Needs review » Reviewed & tested by the community

Dries, if that's the case, then the patch in #12 is RTBC.

Bèr Kessels’s picture

Allthough I think markus was heading the right way, I think fixing things that ain't really broekn should be done after 4.7.

My patch, the one in #12, is by far the simplest solution. Let us commit this and work on the other ten critical issues!

markus_petrux’s picture

Status: Reviewed & tested by the community » Needs review
StatusFileSize
new2.41 KB

Although I agree #12 is good to do... let me try another version that specifies a greater width for the log access details table.

The &nbsp; is motivated by a comment in the "Empty Cells in a Table" section of this page:
http://www.w3schools.com/html/html_tables.asp

Steven’s picture

StatusFileSize
new780 bytes

And here's a patch which actually addresses the problem's source rather than adding in yet another ugly hack...

-1 on the original.

markus_petrux’s picture

+1 for that.

Bèr Kessels’s picture

Status: Needs review » Reviewed & tested by the community

Tested Stevens patch.
It does what it says it does: fix this issue!

It also seems to work with fake XSS referrers, in that way, that they are stripped.

+1

Ber

Steven’s picture

Commited to HEAD.

Zen’s picture

Status: Reviewed & tested by the community » Fixed
Anonymous’s picture

Status: Fixed » Closed (fixed)