Potential open redirect

[Jared Jurkiewicz]

Reported by a co-worker doing security analysis:

This kind of attack is possible when a web application accepts a user-controlled input that specifies a link to an external site. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance.

This is also sometimes called “Open Redirect”.

[James Burke]

I have worked on it in the past, I can do a similar fix for it as done for the DOH stuff, I want to get the fix in for 1.4.2.

[Jared Jurkiewicz]

Great, thanks James!