From a96a535c5af7670997d0c73f1d3e76c500ce992c Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Thu, 9 Jan 2020 20:39:30 +0000 Subject: [PATCH 1/2] Prevent redirect to Host --- modules/context/context.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/context/context.go b/modules/context/context.go index 4b590a7181362..570f3f5ee4b94 100644 --- a/modules/context/context.go +++ b/modules/context/context.go @@ -122,7 +122,7 @@ func (ctx *Context) RedirectToFirst(location ...string) { } u, err := url.Parse(loc) - if err != nil || (u.Scheme != "" && !strings.HasPrefix(strings.ToLower(loc), strings.ToLower(setting.AppURL))) { + if err != nil || ((u.Scheme != "" || u.Host != "") && !strings.HasPrefix(strings.ToLower(loc), strings.ToLower(setting.AppURL))) { continue } From a3123a8e9801075ddc7c8b06ec0a3598d51db6f9 Mon Sep 17 00:00:00 2001 From: zeripath Date: Thu, 9 Jan 2020 21:12:03 +0000 Subject: [PATCH 2/2] Update context.go --- modules/context/context.go | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/context/context.go b/modules/context/context.go index 570f3f5ee4b94..f8663b9c03b07 100644 --- a/modules/context/context.go +++ b/modules/context/context.go @@ -1,4 +1,5 @@ // Copyright 2014 The Gogs Authors. All rights reserved. +// Copyright 2020 The Gitea Authors. All rights reserved. // Use of this source code is governed by a MIT-style // license that can be found in the LICENSE file.