Loading...
 
Skip to main content

Redirects should give absolute URLs

  • Tracker item actions
Trackers
Items
Status
Closed
Subject
Redirects should give absolute URLs
Version
2.x
3.x
Category
  • Error
Feature
All / Undefined
Resolution status
Fixed or Solved
Submitted by
MvGagern
Lastmod by
Ushindi Gedeon
Rating
(0)
Description

Per RFC 2616 Section 14.30Question, the "Location" header given with a HTTP 3xx redirect response must be absolute. TikiWiki violates this requirement, and PHP doesn't fix it up again.

The instance I encountered was the index.php, but a simple "grep -ri 'header.*location' ." in the tikiwiki source tree will list hundreds of more instances of this problem. To see it in a live setup, monitor your network traffic (e.g. using WiresharkQuestion) and visit the root directory of any tikiwiki site, e.g. http://dev.tikiwiki.org/Question. You can then have a look at the HTTP response and notice the incorrect location header.

All user agents that I know of do accept a relative URL as the location of a redirect, and interpret it as relative to the URL of the original request. However, any user agent might decide not to follow such redirects, and it would still conform to HTTP specs. Tikiwiki shouldn't rely on browsers to accept broken behaviour.

Solution
Change all "header('location: ..." function calls so that they include the current scheme (http or https), host name, and an absolute path of the designated target. Probably best to move all this stuff to a new helper function, so that you have to implement and maintain all this environment detection only once.
Workaround
Importance
2
Priority
10
Demonstrate Bug on Tiki 19+
Demonstrate Bug (older Tiki versions)
Ticket ID
2696
Created
Wednesday 26 August, 2009 10:52:27 UTC
by Unknown
LastModif
Thursday 28 May, 2026 13:18:49 UTC


Show PHP error messages