diff options
| author | Dan Fandrich <danf@mageia.org> | 2025-06-06 19:43:01 -0700 |
|---|---|---|
| committer | Dan Fandrich <danf@mageia.org> | 2025-06-06 19:43:01 -0700 |
| commit | b84c02112b0018b612291a2b4692803741e8a6ad (patch) | |
| tree | 0ae648100ccf9ad3f45229a5dd63c9f653783dcd /modules/viewvc | |
| parent | 058146cfdea0ee115b29abd816aa0ba8004311e0 (diff) | |
| download | puppet-master.tar puppet-master.tar.gz puppet-master.tar.bz2 puppet-master.tar.xz puppet-master.zip | |
Diffstat (limited to 'modules/viewvc')
| -rw-r--r-- | modules/viewvc/files/setcookieredirect.html | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/modules/viewvc/files/setcookieredirect.html b/modules/viewvc/files/setcookieredirect.html index 17322c18..fe98b9dc 100644 --- a/modules/viewvc/files/setcookieredirect.html +++ b/modules/viewvc/files/setcookieredirect.html @@ -10,9 +10,9 @@ }); let path = params.to; // Sanitize redirect path to avoid malicious arbitrary redirects - if (/^\/[-a-zA-Z0-9~_.?&=/+]*$/.test(decodeURI(path))) { + if (/^\/[-a-zA-Z0-9~_.?&=/+]*$/.test(decodeURIComponent(path))) { const current = new URL(window.location.toLocaleString()); - window.location.href = current.origin + encodeURI(decodeURI(path)); + window.location.href = encodeURI(current.origin + decodeURIComponent(path)); } else { window.onload = function() { document.getElementById('error').innerHTML = 'Error! Bad redirect location!'; |