6.0.0-beta1
9/18/25

[#4948] Back to browsing that bookmark's folder
Summary Back to browsing that bookmark's folder
Queue Trean
Type Bug
State Resolved
Priority 2. Medium
Owners jan (at) horde (dot) org
Requester pehrle (at) ac-reims (dot) fr
Created 01/29/2007 (6807 days ago)
Due 01/29/2007 (6807 days ago)
Updated 01/30/2007 (6806 days ago)
Assigned 01/29/2007 (6807 days ago)
Resolved 01/30/2007 (6806 days ago)
Github Issue Link
Github Pull Request
Milestone
Patch No

History
01/30/2007 10:48:18 AM Jan Schneider Comment #6
Assigned to Jan Schneider
Taken from Chuck Hagenbuch
State ⇒ Resolved
Reply to this comment
Makes sense, fixed in CVS.
01/30/2007 10:03:28 AM pehrle (at) ac-reims (dot) fr Comment #5 Reply to this comment
I did fix a bad variable name, but that wouldn't affect your case.
Hi Chuck,

At line 48

I need to force ",true" at the call of the function applicationUrl in 
the 1.2 Revision

header('Location: ' . Horde::applicationUrl('browse.php?f=' . 
$bookmark->folder,true));

My install is like

URL : https://servername/horde3

HORDE : cat /usr/share/horde3/lib/Horde.php

   ...

   function applicationUrl($uri, $full = false, $append_session = 0)

     {

         global $re

   ...
01/29/2007 05:07:45 PM Chuck Hagenbuch Comment #4 Reply to this comment
I did fix a bad variable name, but that wouldn't affect your case.
01/29/2007 05:02:17 PM Chuck Hagenbuch Deleted Original Message
 
01/29/2007 05:02:09 PM Chuck Hagenbuch Comment #3
Taken from ben
State ⇒ Feedback
Reply to this comment
I can't reproduce this, and I don't see where XSS can come in either.
01/29/2007 09:53:29 AM Jan Schneider Comment #2
Assigned to ben
Assigned to Chuck Hagenbuch
Reply to this comment
Beside that, this construct is vulnerable to XSS.
01/29/2007 09:15:19 AM pehrle (at) ac-reims (dot) fr Comment #1
Priority ⇒ 2. Medium
Type ⇒ Bug
Summary ⇒ Back to browsing that bookmark's folder
Due ⇒ 01/29/2007
Queue ⇒ Trean
New Attachment: bookmark.php.patch
State ⇒ Unconfirmed
Reply to this comment
Hi,

when i change the rating of a bookmark record, the code :



// Back to browsing that bookmark's folder, unless we were sent a

// next-URL (nu) parameter.

if (!is_null($url = Util::getFormData('nu'))) {

     header('Location: ' . $nu);

} else {

     header('Location: ' . Horde::applicationUrl('browse.php?f=' . 
$bookmark->folder));

}



put the rigtht frame to the horde login page !   (  header('Location: 
' . $nu);  condition is always matched)



I try to put the code

  header('Location: ' . Horde::applicationUrl($url, true));

from edit.php and it works fine.

Thanks,

Saved Queries