fix: validate returnTo parameter in auth callback and update default organization name in welcome page

2026-02-09 09:38:44 +01:00
parent a3e9bac119
commit ead1e006dc
3 changed files with 14 additions and 10 deletions
--- a/app/auth/callback/page.tsx
+++ b/app/auth/callback/page.tsx
@@ -69,8 +69,9 @@ function AuthCallbackContent() {
          if (typeof window !== 'undefined' && localStorage.getItem('pulse_pending_checkout')) {
            router.push('/welcome')
          } else {
-            const returnTo = searchParams.get('returnTo') || '/'
-            router.push(returnTo)
+            const raw = searchParams.get('returnTo') || '/'
+            const safe = (typeof raw === 'string' && raw.startsWith('/') && !raw.startsWith('//')) ? raw : '/'
+            router.push(safe)
          }
        } else {
          setError(authMessageFromErrorType('invalid'))