diff options
| author | zeripath <art27@cantab.net> | 2020-01-09 21:34:25 +0000 |
|---|---|---|
| committer | techknowlogick <techknowlogick@gitea.io> | 2020-01-09 16:34:25 -0500 |
| commit | 6c46a563607de96f11a4248d3656cb158eba80f7 (patch) | |
| tree | a7d09b2ff352b117cc3e0d3b9c2eb655317260cb /modules | |
| parent | 8f31c2fc76823cad96c0880653c545ad12d6974f (diff) | |
| download | gitea-6c46a563607de96f11a4248d3656cb158eba80f7.tar.gz gitea-6c46a563607de96f11a4248d3656cb158eba80f7.zip | |
Prevent redirect to Host (#9678)
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/context/context.go | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/modules/context/context.go b/modules/context/context.go index 4b590a7181..f8663b9c03 100644 --- a/modules/context/context.go +++ b/modules/context/context.go @@ -1,4 +1,5 @@ // Copyright 2014 The Gogs Authors. All rights reserved. +// Copyright 2020 The Gitea Authors. All rights reserved. // Use of this source code is governed by a MIT-style // license that can be found in the LICENSE file. @@ -122,7 +123,7 @@ func (ctx *Context) RedirectToFirst(location ...string) { } u, err := url.Parse(loc) - if err != nil || (u.Scheme != "" && !strings.HasPrefix(strings.ToLower(loc), strings.ToLower(setting.AppURL))) { + if err != nil || ((u.Scheme != "" || u.Host != "") && !strings.HasPrefix(strings.ToLower(loc), strings.ToLower(setting.AppURL))) { continue } |