XWIKI-20612: Sanitize template URLs

xwiki · Feb 2, 2023 · 5c20ff5 · 5c20ff5
1 parent d547210
commit 5c20ff5
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/...iki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/deletespace.vm b/...iki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/deletespace.vm
@@ -29,8 +29,9 @@
     #end
     #set ($cancelURL = $doc.getURL())
     #if ($request.xredirect)
+      ## We don't sanitize this as it will be handled by the server
       #set ($redirectparam = "&amp;xredirect=$escapetool.url($request.xredirect)")
-      #set ($cancelURL = $request.xredirect)
+      #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelURL)
     #end
     #if ($xwiki.hasRecycleBin())
       #set ($confirmationMessage = $services.localization.render('core.space.recyclebin.confirm', ["<em>${escapetool.xml($doc.space)}</em>"]))