Calls of protected_node_access_callback without $_GET['destination'] throw warnings

Created on 2 March 2023, almost 2 years ago
Updated 16 March 2023, almost 2 years ago

Problem/Motivation

If somebody (e.g. Bots) tries to access protected node URLs without a specified destination (e.g. https://host/en/protected-node?protected_page=11554) a warning ist thrown from protected_node_access_callback as it does not check if $_GET['destination'] is set. This fills up the php log if this happens a lot.

Proposed resolution

Check if $_GET['destination'] is set before trying to access it in substr($_GET['destination']. See attached patch.

🐛 Bug report
Status

Fixed

Version

1.0

Component

Code

Created by

🇩🇪Germany meyerrob

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024