1 file changed, 6 insertions, 4 deletions
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index b97bb27..77084e2 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -290,11 +290,13 @@ function get_secret()
 	return secret
 end
 
--- A redirect target is unsafe if a browser would read it as another origin.
--- The only such form cgit can be tricked into signing is a scheme-relative
--- "//host" or "/\host". Everything else stays on this host.
+-- A redirect target is safe only as a path on this host, which starts with
+-- a single "/". A browser reads "//host" and "/\host" as another origin, and
+-- a target that does not start with "/" can name a scheme. cgit signs the
+-- page's own url, which starts with virtual-root, so logins need that to
+-- be a path, as it is by default.
 function is_safe_redirect(url)
-	if type(url) ~= "string" then
+	if type(url) ~= "string" or url:sub(1, 1) ~= "/" then
 		return false
 	end
 	local head = url:sub(1, 2)