Disallow top level domains in Cookie::validateCookieDomain().

This disallows addresses that contain no dots or just a leading one.

Change-Id: I4d62ab3618dddf0d5fafb49c31523137ac33cad2

diff --git a/includes/Cookie.php b/includes/Cookie.php
index ecf4667..d4c342b 100644 (file)
--- a/includes/Cookie.php
+++ b/includes/Cookie.php
@@ -90,13 +90,15 @@ class Cookie {
         * @return Boolean
         */
        public static function validateCookieDomain( $domain, $originDomain = null ) {
-               // Don't allow a trailing dot
-               if ( substr( $domain, -1 ) == '.' ) {
+               $dc = explode( ".", $domain );
+
+               // Don't allow a trailing dot or addresses without a or just a leading dot
+               if ( substr( $domain, -1 ) == '.' ||
+                        count( $dc ) <= 1 ||
+                        count( $dc ) == 2 && $dc[0] === '' ) {
                        return false;
                }
 
-               $dc = explode( ".", $domain );
-
                // Only allow full, valid IP addresses
                if ( preg_match( '/^[0-9.]+$/', $domain ) ) {
                        if ( count( $dc ) != 4 ) {