(ofbiz-framework) branch trunk updated: Implemented: Only accept right URLs as referrer (OFBIZ-13219)

[jleroux]

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 4a28c1c9cd Implemented: Only accept right URLs as referrer 
(OFBIZ-13219)
4a28c1c9cd is described below

commit 4a28c1c9cd8b3e236f9feb89a605e7a48a504826
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Wed Mar 26 08:39:51 2025 +0100

    Implemented: Only accept right URLs as referrer (OFBIZ-13219)
    
    Check that the referrer URL is correct.
---
 applications/party/template/visit/VisitDetail.ftl                  | 7 ++++++-
 .../src/main/java/org/apache/ofbiz/webapp/stats/VisitHandler.java  | 3 +++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/applications/party/template/visit/VisitDetail.ftl 
b/applications/party/template/visit/VisitDetail.ftl
index 6a5cbc7d6b..27b7813893 100644
--- a/applications/party/template/visit/VisitDetail.ftl
+++ b/applications/party/template/visit/VisitDetail.ftl
@@ -69,7 +69,12 @@ under the License.
         </tr>
         <tr>
           <td class="label">${uiLabelMap.PartyInitialReferer}</td>
-          <td><a href="${visit.initialReferrer!}" 
>${visit.initialReferrer!}</a></td>
+          <#assign isUrl = 
Static["org.apache.ofbiz.base.util.UtilValidate"].isUrlInString(visit.initialReferrer)>
+          <#if isUrl>
+              <td><a href="${visit.initialReferrer!}" 
>${visit.initialReferrer!}</a></td>
+          <#else>
+              <td>${visit.initialReferrer!}</td>
+          </#if>
         </tr>
         <tr>
           <td class="label">${uiLabelMap.PartyInitialUserAgent}</td>
diff --git 
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/stats/VisitHandler.java
 
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/stats/VisitHandler.java
index a6cf1f42de..ead695652f 100644
--- 
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/stats/VisitHandler.java
+++ 
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/stats/VisitHandler.java
@@ -137,6 +137,9 @@ public class VisitHandler {
                             Locale initialLocaleObj = (Locale) 
session.getAttribute("_CLIENT_LOCALE_");
                             String initialRequest = (String) 
session.getAttribute("_CLIENT_REQUEST_");
                             String initialReferrer = (String) 
session.getAttribute("_CLIENT_REFERER_");
+                            if (!UtilValidate.isUrlInString(initialReferrer)) {
+                                initialReferrer = "Not an URL";
+                            }
                             String initialUserAgent = (String) 
session.getAttribute("_CLIENT_USER_AGENT_");
 
                             String initialLocale = initialLocaleObj != null ? 
initialLocaleObj.toString() : "";