# any url redirection in function redirect
in function `redirect`，we will redirect to parameter `$url` without any check
```
function redirect($url) {
global $i18n;
// handle expired sessions for ajax requests
if(requestIsAjax() && !cookie_check()){
header('HTTP/1.1 401 Unauthorized', true, 401);
header('WWW-Authenticate: FormBased');
die();
}
if (!headers_sent($filename, $linenum)) {
header('Location: '.$url);
} else {
echo "<html><head><title>".i18n_r('REDIRECT')."</title></head><body>";
if ( !isDebug() ) {
echo '<script type="text/javascript">';
echo 'window.location.href="'.$url.'";';
echo '</script>';
echo '<noscript>';
echo '<meta http-equiv="refresh" content="0;url='.$url.'" />';
echo '</noscript>';
}
echo i18n_r('ERROR').": Headers already sent in ".$filename." on line ".$linenum."\n";
printf(i18n_r('REDIRECT_MSG'), $url);
echo "</body></html>";
}
exit;
}
```
if we can control parameter `$url`, we can lead any url redirection.
just like line 206 in `/admin/changedata.php`，parameter `$redirect_url` input from `$_POST['redirectto']` without any check.
so if we set `$redirect_url` and we can redirect to any url.
京公网安备 11010502034610号
暂无评论