FIX: add exit() after header('Location')

diff --git a/www/auth.php b/www/auth.php
index 8fe38e0c5f275031774203c88e0df32c96dcd42d..6d13f7e21979ba5371cfe57aece534b1bcd8a70f 100644 (file)
--- a/www/auth.php
+++ b/www/auth.php
@@ -230,10 +230,10 @@ if (isset($_POST['start'])) {
     $openid = $message->getArrayFormat();
     if ($GLOBALS['phorkie']['auth']['secure'] > 0 &&
         $GLOBALS['phorkie']['auth']['userlist']) {
     $openid = $message->getArrayFormat();
     if ($GLOBALS['phorkie']['auth']['secure'] > 0 &&
         $GLOBALS['phorkie']['auth']['userlist']) {

-               if (!in_array($openid['openid.identity'], $GLOBALS['phorkie']['users'])) {
+        if (!in_array($openid['openid.identity'], $GLOBALS['phorkie']['users'])) {

             $redirect = 'http://' . $_SERVER['HTTP_HOST'] . "/forbidden";
             header('Location: ' . filter_var($redirect, FILTER_SANITIZE_URL));
             $redirect = 'http://' . $_SERVER['HTTP_HOST'] . "/forbidden";
             header('Location: ' . filter_var($redirect, FILTER_SANITIZE_URL));

-                       exit;
+            exit;

         }
     }
     // include_once 'openid/wrapper.php';
         }
     }
     // include_once 'openid/wrapper.php';


@@ -253,6 +253,7 @@ if (isset($_POST['start'])) {
 
     $redirect = 'http://' . $_SERVER['HTTP_HOST'] . $_SESSION['REQUEST_URI'];
     header('Location: ' . filter_var($redirect, FILTER_SANITIZE_URL));
 
     $redirect = 'http://' . $_SERVER['HTTP_HOST'] . $_SESSION['REQUEST_URI'];
     header('Location: ' . filter_var($redirect, FILTER_SANITIZE_URL));

+    exit;

 }
 
 ?>
 }
 
 ?>

diff --git a/www/secure.php b/www/secure.php
index 5893033574309b842d7286a5674cde0b4dbce604..07cdfb64051768364542a802e85de9a7546cafe8 100644 (file)
--- a/www/secure.php
+++ b/www/secure.php
@@ -7,5 +7,6 @@ require_once 'www-header.php';
 $_SESSION['REQUEST_URI'] = $_SERVER['REQUEST_URI'];
 if (!isset($_SESSION['identity'])) {
     header("Location: /login");
 $_SESSION['REQUEST_URI'] = $_SERVER['REQUEST_URI'];
 if (!isset($_SESSION['identity'])) {
     header("Location: /login");

+    exit;

 }
 ?>
 }
 ?>