Open redirect in crud/default/views/_form.php

[id3s3c]

I was poking at one of my companies internal website and saw that changing the Referer: header redirected me to the location of the URL in it. After talking to the dev we fixed changing the line 103 from:

<?= "<?= " ?>Html::a(Yii::t('app', 'Cancel'), Yii::$app->request->referrer , ['class'=> 'btn btn-danger']) ?>

to

<?= "<?= " ?>Html::a(Yii::t('app', 'Cancel'), parse_url(Yii::$app->request->referrer, PHP_URL_PATH), ['class'=> 'btn btn-danger']) ?>

Cheers.

[victormatuk]

Ye, I have this problem Thanks for show how to fix

[mootensai]

please make PR for this