5770: Forms specifying a redirect in the action are blocked by CSP - Composr CMS feature tracker

ID	Project	Category	View Status	Date Submitted	Last Update

5770	Composr	core	public	2024-05-19 20:43	2024-09-05 18:20

Reporter	PDStig	Assigned To	Guest
Priority	high	Severity	minor
Status	new	Resolution	open
Product Version	11.alpha4

Summary	5770: Forms specifying a redirect in the action are blocked by CSP
Description	Any forms which specify a redirect as part of its action (such as block top login) could get blocked by Content Security Policy in Chrome and Safari due to tightened security. We should work around this by doing an internal redirect via a redirect POST parameter.
Tags	Roadmap: v11
Attach Tags	(Separate by ",")

Time estimation (hours)
Sponsorship open

Date Added	Member	Amount Sponsored

admin 2024-05-19 20:43 administrator ~8770	Automated message: This issue was created using the Report Issue Wizard on the Composr homesite.

Chris Graham 2024-07-25 22:35 administrator ~8960	protect_url_parameter is supposed to be used. Also modify the function comment for protect_url_parameter, _protect_url_parameter, and comment in global2.php against INPUT_FILTER_MODSECURITY_URL_PARAMETER, to also mention browser reflected-XSS filtering.

PDStig 2024-09-05 18:20 administrator ~9282	I added several missing protect_url_parameter but I cannot consider this issue resolved because top_login was not one of them from which this issue originates. top_login gets login URL (+ redirect) from global3.php get_login_url but this is already using protect_url_parameter. So there is another bug somewhere.

View Status	Private (for security issues or disclosing of private information; if you submit as a guest, you will not be able to see your submission)
Note
Upload Files Maximum size: 32,768 KiB	Attach files by dragging & dropping, selecting or pasting them.
You are not logged in	You are not logged in. This means you will not get any e-mail notifications. And if you reply, we will not know for sure you are the original poster of the issue.

Date Modified	Username	Field	Change
2024-07-25 22:35	Chris Graham	Note Added: 0008960
2024-07-25 22:35	Chris Graham	Tag Attached: Roadmap: v11
2024-08-07 20:56	PDStig	Relationship added	related to 5853
2024-08-09 08:12	Guest	Issue cloned: 5865
2024-08-13 01:12	PDStig	Relationship added	has duplicate 5865
2024-09-05 18:20	PDStig	Note Added: 0009282