Accept only a local path as the way back in

is_safe_redirect looked at the first two characters alone, so it
accepted https://evil.example/ and javascript:x. Neither could be
signed today only because cgit always signs a url that starts with
virtual-root, and nothing tested that. A target now has to start with
a single slash, which needs virtual-root to be a path for logins to
work, as it is by default.

0 files changed, 0 insertions, 0 deletions