Fix: #2754 - do not rely on http referer header

6 files changed, 13 insertions, 9 deletions

diff --git a/app/Http/RequestHandlers/BroadcastPage.php b/app/Http/RequestHandlers/BroadcastPage.php
index b627fef34b..ce4cd349fa 100644
--- a/app/Http/RequestHandlers/BroadcastPage.php
+++ b/app/Http/RequestHandlers/BroadcastPage.php
@@ -54,12 +54,10 @@ class BroadcastPage implements RequestHandlerInterface
     public function handle(ServerRequestInterface $request): ResponseInterface
     {
         $user    = $request->getAttribute('user');
-        $referer = $request->getHeaderLine('referer');
         $params  = $request->getQueryParams();
         $body    = $params['body'] ?? '';
         $subject = $params['subject'] ?? '';
         $to      = $params['to'];
-        $url     = $params['url'] ?? $referer;
 
         $to_names = $this->message_service->recipientUsers($to)
             ->map(static function (UserInterface $user): string {
@@ -77,7 +75,6 @@ class BroadcastPage implements RequestHandlerInterface
             'title'    => $title,
             'to'       => $to,
             'to_names' => $to_names,
-            'url'      => $url,
         ]);
     }
 }
diff --git a/app/Http/RequestHandlers/ContactPage.php b/app/Http/RequestHandlers/ContactPage.php
index 5b32968a77..9f9ab79222 100644
--- a/app/Http/RequestHandlers/ContactPage.php
+++ b/app/Http/RequestHandlers/ContactPage.php
@@ -31,6 +31,7 @@ use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 
 use function assert;
 use function in_array;
+use function route;
 
 /**
  * Compose a message from a visitor.
@@ -67,14 +68,13 @@ class ContactPage implements RequestHandlerInterface
         $tree = $request->getAttribute('tree');
         assert($tree instanceof Tree);
 
-        $referer    = $request->getHeaderLine('referer');
         $params     = $request->getQueryParams();
         $body       = $params['body'] ?? '';
         $from_email = $params['from_email'] ?? '';
         $from_name  = $params['from_name'] ?? '';
         $subject    = $params['subject'] ?? '';
         $to         = $params['to'] ?? '';
-        $url        = $params['url'] ?? $referer;
+        $url        = $params['url'] ?? route(HomePage::class);
 
         $to_user = $this->user_service->findByUserName($to);
 
diff --git a/app/Http/RequestHandlers/MessagePage.php b/app/Http/RequestHandlers/MessagePage.php
index a74260754b..8d5bc1883f 100644
--- a/app/Http/RequestHandlers/MessagePage.php
+++ b/app/Http/RequestHandlers/MessagePage.php
@@ -30,6 +30,7 @@ use Psr\Http\Server\RequestHandlerInterface;
 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 
 use function assert;
+use function route;
 
 /**
  * Compose a message from a logged-in user.
@@ -62,11 +63,10 @@ class MessagePage implements RequestHandlerInterface
         assert($tree instanceof Tree);
 
         $user    = $request->getAttribute('user');
-        $referer = $request->getHeaderLine('referer');
         $body    = $request->getQueryParams()['body'] ?? '';
         $subject = $request->getQueryParams()['subject'] ?? '';
         $to      = $request->getQueryParams()['to'] ?? '';
-        $url     = $request->getQueryParams()['url'] ?? $referer;
+        $url     = $request->getQueryParams()['url'] ?? route(HomePage::class);
         $to_user = $this->user_service->findByUserName($to);
 
         if ($to_user === null || $to_user->getPreference(User::PREF_CONTACT_METHOD) === 'none') {
diff --git a/app/Module/UserMessagesModule.php b/app/Module/UserMessagesModule.php
index 2b3d445b01..c22f572ec0 100644
--- a/app/Module/UserMessagesModule.php
+++ b/app/Module/UserMessagesModule.php
@@ -23,6 +23,7 @@ use Fisharebest\Webtrees\Auth;
 use Fisharebest\Webtrees\Carbon;
 use Fisharebest\Webtrees\Contracts\UserInterface;
 use Fisharebest\Webtrees\Filter;
+use Fisharebest\Webtrees\Http\Controllers\HomePageController;
 use Fisharebest\Webtrees\Http\RequestHandlers\MessagePage;
 use Fisharebest\Webtrees\Http\RequestHandlers\MessageSelect;
 use Fisharebest\Webtrees\I18N;
@@ -208,6 +209,7 @@ class UserMessagesModule extends AbstractModule implements ModuleBlockInterface
                         'subject' => $message->subject,
                         'to'      => $user->userName(),
                         'tree'    => $tree->name(),
+                        'url'     => route('user-page', ['tree' => $tree->name()]),
                     ]);
 
                     $content .= '<a class="btn btn-primary" href="' . e($reply_url) . '" title="' . I18N::translate('Reply') . '">' . I18N::translate('Reply') . '</a> ';
diff --git a/app/Services/UserService.php b/app/Services/UserService.php
index 0f2238aee4..893d4e2354 100644
--- a/app/Services/UserService.php
+++ b/app/Services/UserService.php
@@ -400,7 +400,11 @@ class UserService
             $url = 'mailto:' . $contact_user->email();
         } elseif ($user instanceof User) {
             // Logged-in users send direct messages
-            $url = route(MessagePage::class, ['to' => $contact_user->userName(), 'tree' => $tree->name()]);
+            $url = route(MessagePage::class, [
+                'to' => $contact_user->userName(),
+                'tree' => $tree->name(),
+                'url'  => (string) $request->getUri(),
+            ]);
         } else {
             // Visitors use the contact form.
             $url = route(ContactPage::class, [
diff --git a/resources/views/admin/broadcast.phtml b/resources/views/admin/broadcast.phtml
index 3c44553e52..2c54197542 100644
--- a/resources/views/admin/broadcast.phtml
+++ b/resources/views/admin/broadcast.phtml
@@ -2,6 +2,7 @@
 
 use Fisharebest\Webtrees\Http\RequestHandlers\BroadcastAction;
 use Fisharebest\Webtrees\Http\RequestHandlers\ControlPanel;
+use Fisharebest\Webtrees\Http\RequestHandlers\HomePage;
 use Fisharebest\Webtrees\I18N;
 
 ?>
@@ -56,7 +57,7 @@ use Fisharebest\Webtrees\I18N;
             <button type="submit" class="btn btn-primary">
                 <?= I18N::translate('Send') ?>
             </button>
-            <a class="btn btn-link" href="<?= e($url) ?>">
+            <a class="btn btn-link" href="<?= e(route(HomePage::class)) ?>">
                 <?= I18N::translate('cancel') ?>
             </a>
         </div>