J5.x

Behavior change for Uri::isInternal for URLs without protocol

From Joomla! Documentation

Other languages:
English • ‎Nederlands • ‎français

Errors reported[edit]

This release for Joomla 5.1.3 and 4.4.7 changed how Uri::isInternal handles URLs without scheme/protocol. That might lead to redirects, that previously worked, to break after the update.

Versions affected[edit]

General Information

This pertains only to Joomla! version(s): 5.1.3, 4.4.7

What is the cause[edit]

The Uri::isInternal method considered URLs containing a valid hostname but not a scheme ("www.example.org") as internal URLs. This behavior caused multiple attack vectors. With this release, the behavior has been changed. URLs containg a valid hostname will only be considered internal if the scheme ("https://") is provided in the method call and the scheme matches the currently used scheme of the request.

How to fix[edit]

Provide absolute URLs including the scheme/protocol or use relative URLs.