Fix open-redirect via next parameter, remove dead code

2026-08-22 23:45:39 -05:00
parent b4b1ba8470
commit 89e46bf539
4 changed files with 13 additions and 16 deletions
@@ -133,10 +133,7 @@ func (h *Web) setFavorite(w http.ResponseWriter, r *http.Request, star bool) {
 	}
 	itemType := r.FormValue("item_type")
 	itemID := r.FormValue("item_id")
-	next := r.FormValue("next")
-	if next == "" || next[0] != '/' {
-		next = "/"
-	}
+	next := safeRedirectPath(r.FormValue("next"))
 	switch itemType {
 	case "song", "album", "artist":
 	default: