daenamnu/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2026-05-30 23:40:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: enforce APCu availability, fix fixed-window rate limiting, tighten URL validation

Browse Source 
Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/f1016d36-0771-46e0-992c-95ce22594414

Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-05-04 10:06:14 +00:00
committed by GitHub
parent ef58220c09
commit 79e05f33cd
2 changed files with 22 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
php/public/clean-history.js
View File

@@ -12,14 +12,9 @@
// recorded history entry.
const rawTarget = document.currentScript.dataset.target;
// Validate that the redirect target is a safe relative path (starts with '.' or '/').
// This guards against hypothetical injection (e.g. 'javascript:…') even though the
// value is server-set.
const safePattern = /^[./]/;
const unsafePattern = /^\/\//;
const target = (typeof rawTarget === 'string' && safePattern.test(rawTarget) && !unsafePattern.test(rawTarget))
? rawTarget
: '/';
// Only accept the exact relative path we set server-side to prevent any
// potential open-redirect via a manipulated data-target value.
const target = rawTarget === '../../' ? rawTarget : '/';
history.replaceState(null, '', location.pathname);
window.location.replace(target);