Jakub Zych 882d4ee05f fix: image and URL references refuse a /\ path, which browsers read as another host (WR-20) ...

safeImageURL and ValidURLRef refused only //, so a stored og_image of
/\evil.example/x.png loaded a third-party image in the admin. Both now
refuse /\ like models.validTarget already does.

2026-10-27 15:38:56 +01:00

715 B

Raw Blame History

View Raw