openhands
3933214953
Gitea Actions Runner Test / test-job (push) Successful in 1s
CI / check (push) Successful in 33s
CI / tests-integration (push) Successful in 1m42s
CI / tests-unit (push) Successful in 1m47s
CI / tests-ui (push) Successful in 2m30s
CI / preflight (push) Skipped
CI / deploy (push) Failing after 2m56s
- add countArticles() (published-only, mirrors news-list) and warm total_articles - localize homepage metadata; bind articleCount to both stats; unique photo alts - drop duplicate news date and the mascot preload priorities - extract shared AuthPageFrame/AuthUsersCards used by /login and /register - login: localized noindex metadata, session redirect via safeRedirectPath, ?from passthrough from proxy, unified auth roster cache keys, registered notice - register: localized metadata, session redirect to /me, unified cache keys - add resend-verification flow on /verify with rate-limited non-enumerable action - add safeRedirectPath() with unit tests - register form: live requirements checklist + password mismatch guard - login form: unverified state with resend-link CTA - honour prefers-reduced-motion in TypewriterText - add 6 translations across all 25 locales
18 lines
608 B
TypeScript
18 lines
608 B
TypeScript
/**
|
|
* Validate a post-login destination taken from the query string.
|
|
*
|
|
* The value ends up in `window.location.href`, so an unvalidated one turns the
|
|
* sign-in form into an open redirect. Only same-site absolute paths pass:
|
|
* `//host` and `/\host` are cross-origin in every browser, and anything without
|
|
* a leading slash is not a path at all.
|
|
*/
|
|
export function safeRedirectPath(
|
|
raw: string | null | undefined,
|
|
fallback = "/me",
|
|
): string {
|
|
if (!raw) return fallback;
|
|
if (!raw.startsWith("/")) return fallback;
|
|
if (raw.startsWith("//") || raw.startsWith("/\\")) return fallback;
|
|
return raw;
|
|
}
|