feat: only allow relative redirects

Deblok-Workshop · Apr 20, 2024 · 01d9b6b · 01d9b6b
1 parent fb8c013
commit 01d9b6b
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/static/modules/auth.js b/static/modules/auth.js
@@ -160,7 +160,7 @@ async function loginForm() {
       localStorage["DEBLOKAUTH"] = await res.text();
       let redirect = new URLSearchParams(window.location.search).get("redirect_to") || "/"
       document.location =
-        redirect.replaceAll("javascript","");
+        redirect.replaceAll("javascript","").replaceAll("http:","").replaceAll("https:","");
     } else {
       alert(await res.text());
       usrPwd.value = "";
@@ -181,7 +181,7 @@ async function signupForm() {
         localStorage["DEBLOKAUTH"] = await lres.text();
         let redirect = new URLSearchParams(window.location.search).get("redirect_to") || "/"
         document.location =
-          redirect.replaceAll("javascript","");
+          redirect.replaceAll("javascript","").replaceAll("http:","").replaceAll("https:","");
 
       }
     } else {