From cad0c8ac32937f7684d368a7dc98ad8d00508635 Mon Sep 17 00:00:00 2001
From: jonathan <jonathanheindl@gmx.de>
Date: Tue, 28 Dec 2021 21:21:25 +0000
Subject: [PATCH] fixed url injection by means of starting an url with "." and
turning the prefix into a subdomain
---
lib/Properties.hs | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/Properties.hs b/lib/Properties.hs
index c4fc458..3d9b30f 100644
--- a/lib/Properties.hs
+++ b/lib/Properties.hs
@@ -480,7 +480,7 @@ checkTileLayerProperty p@(Property name _value) = case name of
-> do
properties <- askContext <&> getProperties
unless (all (\(Property name value) -> case value of
- StrProp str -> name /= "openWebsite" || "https://static.rc3.world" `isPrefixOf` str
+ StrProp str -> name /= "openWebsite" || "https://static.rc3.world/" `isPrefixOf` str
_ -> True
) properties)
$ complain "\"openWebsiteAllowApi\" can only be used with websites hosted \
--
GitLab