From 1cfa17e48bf1b1ca66b976a00051d481abe3cb8d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=8E=E6=89=AC?= Date: Sat, 24 Jun 2017 22:42:59 +0800 Subject: [PATCH] fix xss --- static/src/js/app/oj/account/login.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/static/src/js/app/oj/account/login.js b/static/src/js/app/oj/account/login.js index 3e35fd05..8f9787ac 100644 --- a/static/src/js/app/oj/account/login.js +++ b/static/src/js/app/oj/account/login.js @@ -28,7 +28,7 @@ require(["jquery", "bsAlert", "csrfToken", "validator"], function ($, bsAlert, c return temp.indexOf("&")>=0 ? temp.split("&")[0] : temp; } var from = getLocationVal("__from"); - if(from != ""){ + if(from != "" && from.substring(0, 1) == "/"){ window.location.href = from; } else{ @@ -48,4 +48,4 @@ require(["jquery", "bsAlert", "csrfToken", "validator"], function ($, bsAlert, c } }); -}); \ No newline at end of file +});