Fixed: Limit redirects after login to local paths

(cherry picked from commit 14005d8d1054eafaba808337a109d5812f3e79e6)
4 months ago · 5fed16c38a
parent 963ffbea4e
commit 5fed16c38a
1 changed files with 1 additions and 1 deletions
--- a/src/Lidarr.Http/Authentication/AuthenticationController.cs
+++ b/src/Lidarr.Http/Authentication/AuthenticationController.cs
@ -47,7 +47,7 @@ namespace Lidarr.Http.Authentication

            await HttpContext.SignInAsync(AuthenticationType.Forms.ToString(), new ClaimsPrincipal(new ClaimsIdentity(claims, "Cookies", "user", "identifier")), authProperties);

-            if (returnUrl.IsNullOrWhiteSpace())
+            if (returnUrl.IsNullOrWhiteSpace() || !Url.IsLocalUrl(returnUrl))
            {
                return Redirect(_configFileProvider.UrlBase + "/");
            }