Properly escape the target in then anti-robot redirect

Any additional URL parameters after a & were previously dropped.

1 files changed, 2 insertions, 2 deletions

diff --git a/modules/viewvc/files/setcookieredirect.html b/modules/viewvc/files/setcookieredirect.html
index acb34af6..17322c18 100644
--- a/modules/viewvc/files/setcookieredirect.html
+++ b/modules/viewvc/files/setcookieredirect.html
@@ -10,9 +10,9 @@
             });
             let path = params.to;
             // Sanitize redirect path to avoid malicious arbitrary redirects
-            if (/^\/[-a-zA-Z0-9~_.?&=/+]*$/.test(path)) {
+            if (/^\/[-a-zA-Z0-9~_.?&=/+]*$/.test(decodeURI(path))) {
                 const current = new URL(window.location.toLocaleString());
-                window.location.href = current.origin + path;
+                window.location.href = current.origin + encodeURI(decodeURI(path));
             } else {
                 window.onload = function() {
                     document.getElementById('error').innerHTML = 'Error! Bad redirect location!';