silverstripe/silverstripe-framework — pull request #3748 by tractorcow (2014-12-31 23:18:47+00:00)
Title: BUG Prevent url= querystring argument override

fixes #1368

The issue can be detected whenever `$_SERVER['QUERY_STRING`]` contains two `url=.*` fragments, where the leading fragment is the one added via .htaccess, and the other the one appended to the url.

Existing url parsing functionality (built on top of parse_str) has been refactored to help and solving this issue, plus a bit of duplicate code cleanup.

I originally attempted to resolve this issue via htaccess, but decided against this, since this issue also affected IIS, and many installations will use custom htaccess rules which would not be immediately upgradable.

Tested on apache (mod_php), iis7, php built in server.