fixed possible open redirect bypass on signin page

Erudika · Aug 1, 2021 · 1c5f4aa · 1c5f4aa
1 parent 677ab76
commit 1c5f4aa
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/main/java/com/erudika/scoold/utils/HttpUtils.java b/src/main/java/com/erudika/scoold/utils/HttpUtils.java
@@ -311,7 +311,7 @@ public static String getBackToUrl(HttpServletRequest req) {
 		}
 		if ((StringUtils.startsWithIgnoreCase(backtoFromCookie, "http://") ||
 				StringUtils.startsWithIgnoreCase(backtoFromCookie, "https://")) &&
-				!StringUtils.startsWithIgnoreCase(backtoFromCookie, ScooldServer.getServerURL())) {
+				!StringUtils.startsWithIgnoreCase(backtoFromCookie, ScooldServer.getServerURL() + "/")) {
 			backtoFromCookie = "";
 		}
 		return (StringUtils.isBlank(backtoFromCookie) ? HOMEPAGE : backtoFromCookie);