XWIKI-20614: Sanitize template URLs

xwiki · Feb 3, 2023 · 8f5a889 · 8f5a889
1 parent a15e782
commit 8f5a889
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/...ki-platform-appwithinminutes-ui/src/main/resources/AppWithinMinutes/DeleteApplication.xml b/...ki-platform-appwithinminutes-ui/src/main/resources/AppWithinMinutes/DeleteApplication.xml
@@ -92,8 +92,9 @@
     'form_token': $services.csrf.token
   })
   #if ("$!request.xredirect" != '')
-    #set ($cancelURL = $request.xredirect)
-    #set ($confirmParams.xredirect = $cancelURL)
+    #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelURL)
+    ## We don't sanitize those parameters as the sanitation will be handled server side.
+    #set ($confirmParams.xredirect = $request.xredirect)
   #end
   #set ($confirmURL = $doc.getURL($xcontext.action, $escapetool.url($confirmParams)))
   {{html}}