Forum OpenACS Q&A: Redirction to external hosts is not allowed

hi,
I have recently installed 5.5 version. I was using 5.1.5 earlier. I am facing a strange issue in 5.5 version. When I try to redirect the home page to my static page it says; "Redirection to external hosts not allowed" whareas both OpenACS & static pages are on same server.

The detailed error output is as below:
------------------------------------------
Redirction to external hosts is not allowed.
while executing
"error "Redirction to external hosts is not allowed.""
(procedure "ad_returnredirect" line 13)
invoked from within
"ad_returnredirect $redirect_url"
invoked from within
"if { $redirect_url ne "" } {
ad_returnredirect $redirect_url
ad_script_abort
}"
("uplevel" body line 29)
invoked from within
"uplevel {
# packages/mbryzek-subsite/www/index.tcl

ad_page_contract {

@author mailto:rhs@mit.edu
@author mailto:mbryzek@mit.edu

@creation-date 2000-..."
(procedure "code::tcl::/var/www/open_qualex/packages/acs-subsite/www/ind..." line 2)
invoked from within
"code::tcl::$__adp_stub"
invoked from within
"if { [file exists $__adp_stub.tcl] } {

# ensure that data source preparation procedure exists and is up-to-date
adp_init tcl $__adp_stub
..."
("uplevel" body line 3)
invoked from within
"uplevel {

if { [file exists $__adp_stub.tcl] } {

# ensure that data source preparation procedure exists and is up-to-date
adp_init t..."
(procedure "adp_prepare" line 2)
invoked from within
"adp_prepare"
invoked from within
"template::adp_parse [file root [ad_conn file]] {}"
(procedure "adp_parse_ad_conn_file" line 6)
invoked from within
"$handler"
("uplevel" body line 2)
invoked from within
"uplevel $code"
invoked from within
"ad_try {
$handler
} ad_script_abort val {
# do nothing
}"
invoked from within
"rp_serve_concrete_file [ad_conn file]"
(procedure "rp_serve_abstract_file" line 60)
invoked from within
"rp_serve_abstract_file "$root/[ad_conn extra_url]""
("uplevel" body line 2)
invoked from within
"uplevel $code"
invoked from within
"ad_try {
rp_serve_abstract_file "$root/[ad_conn extra_url]"
set tcl_url2file([ad_conn url]) [ad_conn file]
set tcl..."
-------------------------------------------------

thanks in advance,
Ratnakar

Collapse
Posted by Dave Bauer on
Can you be more specific. Which code are you using to redirect to your static page.

Redirect to external hosts is NOT allowed unless you use the -allow_complete_url switch to ad_returnredirect.

See: https://openacs.org/api-doc/proc-view?proc=ad_returnredirect

This is there so that an attacker cannot pass a url with return_url=...

to another site where your site will perform a redirect to the attackers web site.

Only use -allow_complete_url where you trust the value that is passed to ad_returnredirect.

Collapse
Posted by Ratnakar Sagare on
Hi Dave,
Thanks for reply,
I am not using any code to redirecting to my static page. I am using 'IndexRedirectUrl' parameter from the subsite parameters to redirect to static page on the same server & not on any external server.
(My redirect page is http://localhost/index.htm)
I have hostname defined in (oacs path)/etc/config.tcl.

Where we can use '-allow_complete_url'?

Ratnakar

Collapse
Posted by Deds Castillo on
Just use /index.htm (without the host part) in the parameter setting
Collapse
Posted by Ratnakar Sagare on
Hi Deds,
Tried this but it didn't work as my OpenACS installation listens on 8000 port & my apache server (who serves the static page- index.htm)is listening on 80 port.

So when I put /index.htm only; it gave (servername:8000/index.htm) page not found error.

Thanks,
Ratnakar

Collapse
Posted by Ryan Gallimore on
Would it be safe to trust the IndexRedirectURL parameter URL?

I would grep the code for IndexRedirectURL to find the call to ad_returnredirect and then add the switch -allow_complete_url.

My opinion is that we can always trust the configured value, so a redirect to another port is possible.

Collapse
Posted by Dave Bauer on
Ryan, that is reasonable, but, that should probably be a relative URL anyway.