# Bug OP-1211 - [security] fixed back url verification

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-1211

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | High |
| Module |  |
| Target versions | 3.0.11 |
| Observed in versions |  |
| Sprint | 3.0.11 |
| Backlog bucket |  |
| Bug found in version (deprecated) |  |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

There is a security problem with the login page and protocol-relative redirect urls.

see:

  - http://www.redmine.org/news/90
  - http://www.redmine.org/projects/redmine/wiki/Security\_Advisories/13

I proposed a PR here: https://github.com/opf/openproject/pull/1060

Marutosi has a PR here: https://github.com/opf/openproject/pull/1059 although the tests fail and it is proposed against the `migrate/1.5_to_2.4` branch

We should backport the fix to `stable` and might do a new maintenance release.