1 files changed, 28 insertions, 0 deletions
diff --git a/modules/viewvc/files/setcookieredirect.html b/modules/viewvc/files/setcookieredirect.html
new file mode 100644
index 00000000..fe98b9dc
--- /dev/null
+++ b/modules/viewvc/files/setcookieredirect.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <title>User check</title>
+        <script type="text/javascript" defer>
+            const randomValue = "6436";  // Chosen by fair dice roll. Guaranteed to be random.
+            document.cookie = `session=${randomValue}; path=/; expires=${new Date(Date.now() + 24*3600*1000).toUTCString()}`;
+            const params = new Proxy(new URLSearchParams(window.location.search), {
+              get: (searchParams, prop) => searchParams.get(prop),
+            });
+            let path = params.to;
+            // Sanitize redirect path to avoid malicious arbitrary redirects
+            if (/^\/[-a-zA-Z0-9~_.?&=/+]*$/.test(decodeURIComponent(path))) {
+                const current = new URL(window.location.toLocaleString());
+                window.location.href = encodeURI(current.origin + decodeURIComponent(path));
+            } else {
+                window.onload = function() {
+                    document.getElementById('error').innerHTML = 'Error! Bad redirect location!';
+                }
+            }
+        </script>
+    </head>
+    <body>
+        Redirecting back...
+        <br>
+        <p id="error"><!-- space for error message --></p>
+    </body>
+</html>