USEFULL
/
gogs
mirror of https://github.com/gogs/gogs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

routes: fix open redirect vulnerability #5364 (#5365)

pull/5380/head
chromium1337 2018-08-06 17:10:16 +08:00 committed by 无闻
parent c9bb33afc3
commit 1f247cf813
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
routes/user/auth.go
View File

@ -73,10 +73,10 @@ func AutoLogin(c *context.Context) (bool, error) {
} }
// isValidRedirect returns false if the URL does not redirect to same site. // isValidRedirect returns false if the URL does not redirect to same site.
// False: //url, http://url // False: //url, http://url, /\url
// True: /url // True: /url
func isValidRedirect(url string) bool { func isValidRedirect(url string) bool {
return len(url) >= 2 && url[0] == '/' && url[1] != '/' return len(url) >= 2 && url[0] == '/' && url[1] != '/' && url[1] != '\\'
} }
func Login(c *context.Context) { func Login(c *context.Context) {