Non-trac based bounce

this is a moot ticket until we fix #2935 and fix the bounce url being provided to SSO and thus back to us.

You shouldn't do this - it's an open redirect to any user-supplied URL.

I don't know if mod_rewrite has sufficient mojo to catch all tricks that can sneak a domain through a simple check:

RewriteCond? %{QUERY_STRING} bounce=http://beaversource.oregonstate.edu

doesn't necessarily work, because there are attacks that embed the domain as the "username" part of the http request (others as well, this is a simple example):

bounce=http://beaversource.oregonstate.edu@onidphishing.com

I don't know what the 100% solution is, but would advise you to do the redirection in code (not necessarily trac) and not using mod_rewrite, so it's trivial to fix if a problem shows up.

(In [189]) re #2933 As per hopson's security comment, i'm removing the mod_rewrite based version and we'll code up a simple php page to handle this. (At the time of putting the code into trac, we didn't have a social side or any php components with which to do this).

(In [208]) refs #2827 , #3026 , #2890 , #2935 , #2985, #2933 , #2887 , #3935, #2929 , #2931 Creating new tag

My proposed script for bounce is:

bounce.php

<?php

if($_REQUEST){
    foreach ($_REQUEST as $key => $value) {
        if($key == "bounce"){
            header('Location: http://' . $_SERVER['SERVER_NAME'] . $value);
        }
    }

}

?>

(In [212]) re #2933

checking of the bounce script that SSO will point to

(In [230]) refs #2674, #2933, #3041, #3043, #3068, #2675, #2677 Creating a new tag, the tickets above are the ones fixed in this tag.