0.1.38 gateway

server/internal/api/installer_auth.go

@@ -261,16 +261,33 @@ func (s *Server) handleInstallLogout(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/install", http.StatusSeeOther)
 }
 
+// cleanInstallerDestination decides where a sign-in may return to.
+//
+// It admits any /admin path other than the API, because the console is a single-page
+// application now and its routes are its own: there is no list in Go to check them
+// against, and there should not be — a page added to the console would otherwise have to
+// be declared here as well, and the failure when somebody forgot would be a sign-in that
+// silently landed on the wrong screen. That was already the case for the account and
+// settings-history pages, whose URLs carry an id: neither could be named here, so signing
+// in from either dropped the operator back on the user list.
+//
+// What it must still refuse is anything that is not a path on this origin — an absolute
+// URL, a scheme-relative //host, or a backslash some browsers normalise into one — since
+// this value ends up in a redirect and an open redirect from an admin sign-in is a real
+// one. Everything that is not clearly an admin path falls back to the installer.
 func cleanInstallerDestination(value string) string {
 	value = strings.TrimSpace(value)
-	if value == "/admin/" {
+	if !strings.HasPrefix(value, "/admin") {
+		return "/install"
+	}
+	if strings.HasPrefix(value, "//") || strings.ContainsAny(value, "\\\r\n") {
+		return "/install"
+	}
+	if strings.HasPrefix(value, "/admin/api/") {
 		return "/admin/"
 	}
-	if strings.HasPrefix(value, "/admin/") {
-		page := strings.TrimPrefix(value, "/admin/")
-		if adminPages[page] {
-			return value
-		}
+	if value == "/admin" {
+		return "/admin/"
 	}
-	return "/install"
+	return value
 }