fix(settings): prevent open redirect via protocol-relative redirect paths

Algorithm5838 · Algorithm5838 · commit 0aa23b0d1944 · 2026-04-26T23:43:14.000+03:00
diff --git a/src/settings.rs b/src/settings.rs
@@ -113,11 +113,7 @@ fn set_cookies_method(req: Request<Body>, remove_cookies: bool) -> Response<Body
 	let path = match form.get("redirect") {
 		Some(value) => {
 			let value = value.replace("%26", "&").replace("%23", "#");
-			if value.starts_with('/') {
-				value
-			} else {
-				format!("/{value}")
-			}
+			format!("/{}", value.trim_start_matches(|c| c == '/' || c == '\\'))
 		}
 		None => "/".to_string(),
 	};
