* SetHandler application/x-httpd-php * * 2. Keep $SITE_SECRETS below in sync with the 'transfer_secret' entries in * blog_en.py / blog_de.py — postfeed-intl.py signs each link with the * secret for the blog it's posting to, and this page must verify against * the exact same value for the domain it's running on. * * Only URLs carrying a valid HMAC-SHA256 signature (produced by * postfeed-intl.py at publish time, using the secret for the requesting * site) are ever redirected to — this page cannot be used by outside * parties as a generic open redirector, and cannot be invoked at all * except on these two domains. * * Backward compatibility: posts published before signing was introduced * link here with no &sig= at all. Those are honored only when the request's * Referer is this same site — i.e. the visitor actually clicked the link * from an old post page on this domain. An outside party sharing a bare * transfer.html?url=... link has no such referer (browsers don't send one * for a pasted/typed URL, and a foreign site's referer won't match this * host), so this does not reopen the open-redirect hole for new abuse — * it only lets already-published, already-existing links keep working. */ declare(strict_types=1); const SITE_SECRETS = [ 'itsecuritynews.info' => 'da7b1edf2e14579d516d8154e9f384c4bc4afdf7fc979c96d4bd22e648124288', 'itsicherheitnews.de' => '4decf809612e7c813d14d8bf4740043db11159ee15e269a00c003327037b3004', ]; // Normalize the requesting host (drop port, leading "www.") and require it // to be exactly one of the two known sites — anything else gets a bare 403 // with no page body at all, before any URL/signature handling happens. $host = strtolower(explode(':', $_SERVER['HTTP_HOST'] ?? '')[0]); $host = preg_replace('/^www\./', '', $host); if (!array_key_exists($host, SITE_SECRETS)) { http_response_code(403); exit('Forbidden'); } $transferSecret = SITE_SECRETS[$host]; $rawUrl = $_GET['url'] ?? ''; $sig = $_GET['sig'] ?? ''; $targetUrl = null; if ($rawUrl !== '') { $scheme = parse_url($rawUrl, PHP_URL_SCHEME); $schemeOk = ($scheme === 'http' || $scheme === 'https'); if ($sig !== '') { // Current-format link — the signature must verify; no fallback. $expected = hash_hmac('sha256', $rawUrl, $transferSecret); if ($schemeOk && hash_equals($expected, $sig)) { $targetUrl = $rawUrl; } } else { // Legacy link (no &sig=) — only honored when the visitor came from // a page on this same site (see the backward-compatibility note // above). Anything else — no referer, or a foreign one — is refused. $refererHost = strtolower(parse_url($_SERVER['HTTP_REFERER'] ?? '', PHP_URL_HOST) ?? ''); $refererHost = preg_replace('/^www\./', '', $refererHost); if ($schemeOk && $refererHost !== '' && $refererHost === $host) { $targetUrl = $rawUrl; } } } ?> Redirecting…

This link is not valid

The redirect link is missing, malformed, or wasn't issued by IT Security News.

Go to the homepage

Redirecting you to the article in 7 seconds…

Continue now →

Follow us

Guest Posts

We accept posts about your own product(s) or topic(s) if they are related to IT Security.

Advertise with us