From 5fed16c38a91a8a85b1aae87feb952029c1bb5dd Mon Sep 17 00:00:00 2001 From: Mark McDowall Date: Tue, 20 Aug 2024 14:46:36 -0700 Subject: [PATCH] Fixed: Limit redirects after login to local paths (cherry picked from commit 14005d8d1054eafaba808337a109d5812f3e79e6) --- src/Lidarr.Http/Authentication/AuthenticationController.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Lidarr.Http/Authentication/AuthenticationController.cs b/src/Lidarr.Http/Authentication/AuthenticationController.cs index 447ea4c22..2fc588dd2 100644 --- a/src/Lidarr.Http/Authentication/AuthenticationController.cs +++ b/src/Lidarr.Http/Authentication/AuthenticationController.cs @@ -47,7 +47,7 @@ namespace Lidarr.Http.Authentication await HttpContext.SignInAsync(AuthenticationType.Forms.ToString(), new ClaimsPrincipal(new ClaimsIdentity(claims, "Cookies", "user", "identifier")), authProperties); - if (returnUrl.IsNullOrWhiteSpace()) + if (returnUrl.IsNullOrWhiteSpace() || !Url.IsLocalUrl(returnUrl)) { return Redirect(_configFileProvider.UrlBase + "/"); }