# Bug OP-18882 - External links with encoded space in path lead to OpenProject home page

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-18882

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module | DevSecOps / Security |
| Target versions | 17.1.1 |
| Observed in versions | 17.1.0 |
| Sprint | 17.1.1 |
| Backlog bucket |  |
| Bug found in version (deprecated) | 17.1.x |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers | Oliver Günther |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Steps to reproduce

1.  Create a work package

2.  In the description add a link with an encoded space or umlaut in a URL path, for example [`https://www.test.org/foo/1%20bar/baz`](https://www.test.org/foo/1%20bar/baz)  or `https://example.com/?ümlaut=1`

3.  After having saved the work package and viewing it, click on the link

### What is the buggy behavior?

  - The user gets redirected to the OpenProject installation's home page (/)

### What is the expected behavior?

  - The user should be redirected to <https://www.test.org/foo/1%20bar/baz>

### Workaround

Instead of clicking it, select the text of the link, copy it, and paste it into the browser.

### 

### 

### 

### Environment information

**OpenProject version**

*v17.1.0*

### Comments

The captured link for the example would look like this:

<https://my.openproject.com/external_redirect?url=https://www.test.org/foo/1%2520/baz>

The slashes etc. would've been encoded too (to `%2F` for instance) but I ommitted that here for readability.