In addition, the credit information for this report again appears to be not state the facts correctly. The issue with
?return= was something that I've previously complained about, and the development team chose not to fix at the time.
The CVE indicator of 2014 makes it appear that the vulnerability was first identified in 2014, but in fact, it's one
that's been known about since a lot earlier - but previous developers argued not to fix I believe (I'll need to pull
out a old HDD and go for chat logs to confirm).
For example, I have test web requests stored demonstrating this issue since at least April 2013
(http://tinypic.com/r/k0pee/8) , and I believe that actually the identification of this issue pre-dates this.
Therefore, I don't believe it is correct to state that the issue was first reported by “Mathias Karlsson” in May 2014,
when it was identified as an issue prior to April 2013.
Equally, I don't believe that putting in the description Paul Richards also found another redirection issue in
permalink_page.php, which turned out to have the same root cause. is a valid indication of the issue - in terms of the
?return parameter, Mantis used the same functionality in around 4-5 pages.
In addition, whilst I did state that I would leave testing of the fix to someone else, the final fix for this issue
looks rather similar to the proposal fix I suggested for further testing of:
[23:16:46] <paulr> if ( preg_match( '@^(?P<path>' . preg_quote( $t_path, '@' ) . ')' . $t_pattern . '$@',
$t_url, $t_matches ) ) {
[23:16:46] <paulr> $t_type = 1;
[23:16:46] <paulr> - } else if ( preg_match( '@^(?P<path>' . preg_quote( $t_short_path, '@' ) . ')' . $t_pattern
. '$@', $t_url, $t_matches ) ) {
[23:16:46] <paulr> + } else if ( $t_short_path != '' && ( preg_match( '@^(?P<path>' . preg_quote( $t_short_path,
'@' ) . ')' . $t_pattern . '$@', $t_url, $t_matches ) ) ) {
[23:16:46] <paulr> $t_type = 2;
[23:16:46] <paulr> } else if ( preg_match( '@^(?P<path>)' . $t_pattern . '$@', $t_url, $t_matches ) ) {
[23:16:46] <paulr> $t_type = 3;
[23:16:46] <paulr> }
[23:16:46] <paulr>
[23:16:57] <paulr> not directly related or well
[23:17:07] <paulr> i'm wondering if the above would be correct or not ;p
Paul
