From: El Alemaño <victor@dom.de>
Subject: [PATCH] SA-CONTRIB-2015-067 - Finder - Open Redirect

---
 includes/form.inc | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/includes/form.inc b/includes/form.inc
index e347e3c..82c0553 100644
--- a/includes/form.inc
+++ b/includes/form.inc
@@ -526,11 +526,20 @@ function finder_form_state($finder, $form_state = NULL) {
  */
 function finder_form_goto($sep, $path = '', $query = NULL, $fragment = NULL, $http_response_code = 302) {

+  $destination = FALSE;
   if (isset($_REQUEST['destination'])) {
-    extract(parse_url(urldecode($_REQUEST['destination'])));
+    $destination = $_REQUEST['destination'];
   }
   elseif (isset($_REQUEST['edit']['destination'])) {
-    extract(parse_url(urldecode($_REQUEST['edit']['destination'])));
+    $destination = $_REQUEST['edit']['destination'];
+  }
+
+  if($destination) {
+    $colonpos = strpos($destination, ':');
+    $absolute = ($colonpos !== FALSE && !preg_match('![/?#]!', substr($destination, 0, $colonpos)));
+    if (!$absolute) {
+      extract(parse_url(urldecode($destination)));
+    }
   }

   $url = url($path, array('query' => $query, 'fragment' => $fragment, 'absolute' => TRUE));
@@ -557,4 +566,4 @@ function finder_form_goto($sep, $path = '', $query = NULL, $fragment = NULL, $ht
   // some cases this can be wrong, so we make sure none of the code below the
   // drupal_goto() call gets executed upon redirection.
   exit();
-}
\ No newline at end of file
+}
--
1.9.5 (Apple Git-50.3)