/**
* Checks whether a URL is a valid redirect.
*
* This is a helper function for mymodule_check_user().
*
* @param string $url
* The URL for a requested redirect.
*
* @return bool
* TRUE if the redirect should be allowed, FALSE if not.
*/
function _mymodule_redirect_allowed($url) {
// Allow internal redirects.
if (!url_is_external($url)) {
return TRUE;
}
// Do not redirect to an invalid URL.
if (filter_var($url, FILTER_VALIDATE_URL, FILTER_FLAG_PATH_REQUIRED)) {
return FALSE;
}
$host = parse_url($url, PHP_URL_HOST);
if (empty($host)) {
return FALSE;
}
// Allow any subdomain of harvard.edu.
if (preg_match('/\.harvard\.edu$/', $host)) {
return TRUE;
}
// Allow any domain ...
static $allowed_domains = [
'allowed-1.com',
// ...
'allowed-24.org',
];
if (in_array($host, $allowed_domains)) {
return TRUE;
}
// Also allow the www. subdomain of any such domain.
list($subdomain, $parent) = explode('.', $host, 2) + ['', ''];
return $subdomain === 'www' && in_array($parent, $allowed_domains);
}
