tabshift/payload
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
96289bf555cba528393d18695718fe3128130289
payload/packages
History
Patrik 96289bf555 fix(next): block encoded and escaped open redirects in getSafeRedirect (#11907) 
### What

This PR improves the `getSafeRedirect` utility to improve security
around open redirect handling.

### How

- Normalizes and decodes the redirect path using `decodeURIComponent`
- Catches malformed encodings with a try/catch fallback
- Blocks open redirects
2025-03-31 13:11:34 -04:00
..
admin-bar
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
create-payload-app
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
db-mongodb
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
db-postgres
feat(db-*): export types from main export (#11914)
2025-03-31 15:45:02 +00:00
db-sqlite
feat(db-*): export types from main export (#11914)
2025-03-31 15:45:02 +00:00
db-vercel-postgres
feat(db-*): export types from main export (#11914)
2025-03-31 15:45:02 +00:00
drizzle
feat(db-*): export types from main export (#11914)
2025-03-31 15:45:02 +00:00
email-nodemailer
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
email-resend
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
eslint-config
chore(release): eslint/3.28.0
2025-03-11 17:19:36 -04:00
eslint-plugin
chore(release): eslint/3.28.0
2025-03-11 17:19:36 -04:00
graphql
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
live-preview
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
live-preview-react
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
live-preview-vue
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
next
fix(next): block encoded and escaped open redirects in getSafeRedirect (#11907)
2025-03-31 13:11:34 -04:00
payload
perf: prefer async fs calls (#11918)
2025-03-29 10:58:54 -06:00
payload-cloud
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
plugin-cloud-storage
fix(plugin-cloud-storage): ensure client handlers are added to import map regardless of enabled state (#11880)
2025-03-26 18:13:32 +00:00
plugin-form-builder
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
plugin-import-export
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
plugin-multi-tenant
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
plugin-nested-docs
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
plugin-redirects
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
plugin-search
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
plugin-sentry
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
plugin-seo
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
plugin-stripe
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
richtext-lexical
fix(richtext-lexical): incorrectly hidden fields in drawers due to incorrect permissions handling (#11883)
2025-03-26 15:04:55 -06:00
richtext-slate
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
storage-azure
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
storage-gcs
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
storage-s3
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
storage-uploadthing
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
storage-vercel-blob
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
translations
chore(release): v3.31.0 [skip ci]
2025-03-25 14:28:01 -04:00
ui
fix(ui): switching languages does not update cached client config (#11725)
2025-03-28 17:49:28 -04:00