Fix open redirect vulnerability in LoginController

[Copilot]

The LoginController uses unsanitized $_GET['redirect'] and $_POST['redirect_url'] parameters directly in header() redirects, allowing attackers to redirect authenticated users to external malicious sites.

Changes

• Added isValidRedirectUrl() private method to validate redirect URLs:

  • Rejects URLs with schemes (http://, https://, javascript:, data:, etc.)
  • Rejects protocol-relative URLs (//evil.com)
  • Only allows internal paths starting with /
  • Falls back to /admin/dashboard for invalid URLs

• Updated showLoginForm() to validate $_GET['redirect'] before passing to view

• Updated login() to validate $_POST['redirect_url'] before redirect

private function isValidRedirectUrl( string $url ): bool
{
    if( empty( $url ) )
    {
        return false;
    }
    
    // Reject URLs with schemes (http://, https://, javascript:, etc.)
    if( preg_match( '#^[a-z][a-z0-9+.-]*:#i', $url ) )
    {
        return false;
    }
    
    // Reject protocol-relative URLs (//example.com)
    if( str_starts_with( $url, '//' ) )
    {
        return false;
    }
    
    return str_starts_with( $url, '/' );
}

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Note

Free review on us!

CodeRabbit is offering free reviews until Fri Nov 07 2025 to showcase some of the refinements we've made.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}