pfSense

PR: https://github.com/pfsense/pfsense/pull/4599

Not sure I follow how this makes it any less secure than it already is. If a user is logged in already, they can still click on a malicious link... what part of this change makes the attack surface larger?

Doesn't have to be an attack, they could also do it unintentionally by bookmarking or hitting a page from their history that does it.

Just because they can do it while logged in doesn't mean it should be allowed when they aren't. It's an extra layer of protection, part of defense in depth.

But, again- nothing prevents a logged in user from bookmarking a page or recalling one from history that actions something unintentional NOW. So this change doesn't really move that needle one way or the other.

What about if I modify it so it only takes you to the base URI (strips away all parameters/arguments). Would that be acceptable?

edit: I went ahead and did this anyway. Instead of stripping the params (which, as Jim Pingle mentions, breaks some pages) it simply ignores the redirecturi if it contains params. See patch v2

Some pages require parameters to load the right view, so stripping the parameters isn't helpful.

It is not going to be allowed in any form.

I understand.

To be honest, one of my main reasons for wanting this merged was because my dashboard takes so darn long to display (close to 5 whole seconds).

So, I hope this can get reconsidered once that POST / CSRF work is complete.

Is there a redmine for that to track progress?