fix open redirect

2026-01-15 08:01:05 +10:00
parent cad78c30ae
commit 33d390a612
1 changed files with 23 additions and 1 deletions
--- a/public/script.js
+++ b/public/script.js
@@ -1,4 +1,26 @@
 let SM = {
+    redirectIfSafe: (target) => {
+        if (typeof target !== 'string' || target === '') {
+            window.location.assign('/');
+            return;
+        }
+
+        let url;
+        try {
+            url = new URL(target, window.location.origin);
+        } catch (error) {
+            window.location.assign('/');
+            return;
+        }
+
+        if (url.origin !== window.location.origin) {
+            window.location.assign('/');
+            return;
+        }
+
+        window.location.assign(url.href);
+    },
+
    alert: (title, text, type = 'info') =>{
        const data = {
            position: 'top-end',
@@ -84,7 +106,7 @@ let SM = {
                axios.delete(url)
                .then((response) => {
                    if(response.data.success){
-                        window.location.href = response.data.redirect;
+                        SM.redirectIfSafe(response.data.redirect);
                    }
                })
                .catch(() => {