1 Commits

Author	SHA1	Message	Date
Jakub Zych	882d4ee05f	fix: image and URL references refuse a /\ path, which browsers read as another host (WR-20) ... safeImageURL and ValidURLRef refused only //, so a stored og_image of /\evil.example/x.png loaded a third-party image in the admin. Both now refuse /\ like models.validTarget already does.	2026-10-27 15:38:56 +01:00