security: CAPA privilege escalation, CSV injection, AI rate-limit, prompt injection guard, open redirect, timing-safe cron secret, server-only admin client, notifications RLS

2026-07-12 17:33:58 +08:00
parent c0ec6660ef
commit c80091c8d6
7 changed files with 49 additions and 6 deletions
@@ -36,7 +36,7 @@ export async function middleware(request: NextRequest) {

  if (user && (pathname === '/' || pathname === '/login')) {
    const redirect = request.nextUrl.searchParams.get('redirect')
-    if (redirect && redirect.startsWith('/')) {
+    if (redirect && redirect.startsWith('/') && !redirect.startsWith('//')) {
      const url = request.nextUrl.clone()
      url.pathname = redirect
      url.search = ''