mirror of
https://github.com/HeyPuter/puter.git
synced 2026-09-15 01:35:37 +00:00
Nariman Jelveh
e052aec7fb
A share email lands on `/?shared=…`, and its recipient is signed out or in a temporary session more often than not. Password login reloads the same URL, so the link came back with it — but an OIDC login leaves the origin and returns to a URL the backend builds from a whitelist of bare paths. `return_to` was a pathname only, and `/` wasn't on the list, so the recipient came back signed in on the Dashboard's Apps tab with nothing to say what had just been shared with them. `shared` now travels with the path. The GUI sends it along with the return path; the backend accepts it as the one parameter a `return_to` may carry, and only values shaped like the masked share path the mail was built from — everything else rejects the whole value, the path is still matched as a raw string so a protocol-relative one can't smuggle an origin through, and the query is rebuilt rather than reflected. The items ride onto the error page too, so a failed attempt retries on the link instead of losing it. The root joins the whitelist for this, but only when it names something: on its own it is where the flow already lands.