r888888888/danbooru — pull request #1813 by kxz (2013-06-26 16:19:26+00:00)
Title: Restrict post-login redirection targets to local URLs

The login page doesn't check that the `url` parameter is a local URL before redirecting to it; e.g. will happily take you to , leaving users open to phishing attacks if the target is a malicious site. This pull request only accepts `params[:url]` as a redirect target if it begins with a `/`, closing this vulnerability.