public static function sanitizeLocalUrl($url = '') {
		$sanitizedUrl = '';
		$decodedUrl = rawurldecode($url);

		if (!empty($url) && self::removeXSS($decodedUrl) === $decodedUrl) {
			$testAbsoluteUrl = self::resolveBackPath($decodedUrl);
			$testRelativeUrl = self::resolveBackPath(
				self::dirname(self::getIndpEnv('SCRIPT_NAME')) . '/' . $decodedUrl
			);

				// Pass if URL is on the current host:
			if (self::isValidUrl($decodedUrl)) {
				if (self::isOnCurrentHost($decodedUrl) && strpos($decodedUrl, self::getIndpEnv('TYPO3_SITE_URL')) === 0) {
					$sanitizedUrl = $url;
				}
				// Pass if URL is an absolute file path:
			} elseif (self::isAbsPath($decodedUrl) && self::isAllowedAbsPath($decodedUrl)) {
				$sanitizedUrl = $url;
				// Pass if URL is absolute and below TYPO3 base directory:
			} elseif (strpos($testAbsoluteUrl, self::getIndpEnv('TYPO3_SITE_PATH')) === 0 && substr($decodedUrl, 0, 1) === '/') {
				$sanitizedUrl = $url;
				// Pass if URL is relative and below TYPO3 base directory:
			} elseif (strpos($testRelativeUrl, self::getIndpEnv('TYPO3_SITE_PATH')) === 0 && substr($decodedUrl, 0, 1) !== '/') {
				$sanitizedUrl = $url;
			}
		}

		if (!empty($url) && empty($sanitizedUrl)) {
			self::sysLog('The URL "' . $url . '" is not considered to be local and was denied.', 'Core', self::SYSLOG_SEVERITY_NOTICE);
		}

		return $sanitizedUrl;
	}
public static function sanitizeLocalUrl($url = '') {
		$sanitizedUrl = '';
		$decodedUrl = rawurldecode($url);

		if (!empty($url) && self::removeXSS($decodedUrl) === $decodedUrl) {
			$testAbsoluteUrl = self::resolveBackPath($decodedUrl);
			$testRelativeUrl = self::resolveBackPath(
				self::dirname(self::getIndpEnv('SCRIPT_NAME')) . '/' . $decodedUrl
			);

				// Pass if URL is on the current host:
			if (self::isValidUrl($decodedUrl)) {
				if (self::isOnCurrentHost($decodedUrl) && strpos($decodedUrl, self::getIndpEnv('TYPO3_SITE_URL')) === 0) {
					$sanitizedUrl = $url;
				}
				// Pass if URL is an absolute file path:
			} elseif (self::isAbsPath($decodedUrl) && self::isAllowedAbsPath($decodedUrl)) {
				$sanitizedUrl = $url;
				// Pass if URL is absolute and below TYPO3 base directory:
			} elseif (strpos($testAbsoluteUrl, self::getIndpEnv('TYPO3_SITE_PATH')) === 0 && substr($decodedUrl, 0, 1) === '/') {
				$sanitizedUrl = $url;
				// Pass if URL is relative and below TYPO3 base directory:
			} elseif (strpos($testRelativeUrl, self::getIndpEnv('TYPO3_SITE_PATH')) === 0 && substr($decodedUrl, 0, 1) !== '/') {
				$sanitizedUrl = $url;
			}
		}

		if (!empty($url) && empty($sanitizedUrl)) {
			self::sysLog('The URL "' . $url . '" is not considered to be local and was denied.', 'Core', self::SYSLOG_SEVERITY_NOTICE);
		}

		return $sanitizedUrl;
	}
public static function sanitizeLocalUrl ( $ url = '' ) { $ sanitizedUrl = '' ; $ decodedUrl = rawurldecode ( $ url ) ; if ( ! empty ( $ url ) && self :: removeXSS ( $ decodedUrl ) === $ decodedUrl ) { $ testAbsoluteUrl = self :: resolveBackPath ( $ decodedUrl ) ; $ testRelativeUrl = self :: resolveBackPath ( self :: dirname ( self :: getIndpEnv ( 'SCRIPT_NAME' ) ) . '/' . $ decodedUrl ) ; // Pass if URL is on the current host: if ( self :: isValidUrl ( $ decodedUrl ) ) { if ( self :: isOnCurrentHost ( $ decodedUrl ) && strpos ( $ decodedUrl , self :: getIndpEnv ( 'TYPO3_SITE_URL' ) ) === 0 ) { $ sanitizedUrl = $ url ; } // Pass if URL is an absolute file path: } elseif ( self :: isAbsPath ( $ decodedUrl ) && self :: isAllowedAbsPath ( $ decodedUrl ) ) { $ sanitizedUrl = $ url ; // Pass if URL is absolute and below TYPO3 base directory: } elseif ( strpos ( $ testAbsoluteUrl , self :: getIndpEnv ( 'TYPO3_SITE_PATH' ) ) === 0 && substr ( $ decodedUrl , 0 , 1 ) === '/' ) { $ sanitizedUrl = $ url ; // Pass if URL is relative and below TYPO3 base directory: } elseif ( strpos ( $ testRelativeUrl , self :: getIndpEnv ( 'TYPO3_SITE_PATH' ) ) === 0 && substr ( $ decodedUrl , 0 , 1 ) !== '/' ) { $ sanitizedUrl = $ url ; } } if ( ! empty ( $ url ) && empty ( $ sanitizedUrl ) ) { self :: sysLog ( 'The URL "' . $ url . '" is not considered to be local and was denied.' , 'Core' , self :: SYSLOG_SEVERITY_NOTICE ) ; } return $ sanitizedUrl ; }
Checks if a given string is a valid frame URL to be loaded in the
backend.

@param string $url potential URL to check
@return string either $url if $url is considered to be harmless, or an
empty string otherwise
Checks if a given string is a valid frame URL to be loaded in the backend .