Redirects from uploads in "file" module fail.

[nbkhwjm]

The URL eventually given to the PHP header Location function contains converted html entities and the browser fails to properly redirect. This may be happening elsewhere, but Ive focused on the redirect from "Files"

Flow (sorry if this seems overly detailed, its kinda the way we document issues where I'm at)

In "files"-> "addedit.php" there is a hidden post value called "redirect"
<input type="hidden" name="redirect" value="<?php echo $referrer; ?>" />

Which is derived from

$referrerArray = parse_url($_SERVER['HTTP_REFERER']);
$referrer = $referrerArray['query'] . $referrerArray['fragment'];

which is passed to the form handler in "do_file_aed.php"
$redirect = dPgetCleanParam($_POST, 'redirect', '');

for cleaning in "main_functions.php" --> dPgetCleanParam which returns "filter_xss($val)"

which is in filter.php --> filter_xss that converts the entity..
$string = str_replace('&', '&', $string);

this is passed to $AppUI->redirect($redirect); in the same file do_file_aed.php.

ui.class.php --> redirect then uses this value in the php header Location:
header('Location: index.php?' . $params);

this still has the html Entity, I'm guessing that the browsers now do not interpret the entities the same way, but to make this work properly I had to convert the & back to & with;

$params = str_replace('&', '&', $params);
$loc = "index.php?" . $params;
header("Location: " . $loc);

I've added this change in mine, but wanted to see if anyone thinks there is a better way.

[Banditpong]

What about doing a urlencode(html_entity_decode($redirect)) with the $redirect, before passing it to $AppUI->redirect()?

[nbkhwjm]

I would think you would then loose the benefit of filter_xss.. would it not?

[Banditpong]

I think/hope dPgetCleanParam should clean up the variable and only allow a specific set of tags through.

[nbkhwjm]

that's the point, dPgetCleanParam uses filter_xss to convert them to entities, but they are never converted back for direct use in redirect. Im converting just that one for compatibility with the Location header.