🚑 disallow redirecting landing page

owid · Aug 5, 2024 · b2fa810 · b2fa810
1 parent 971913e
commit b2fa810
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/adminSiteClient/SiteRedirectsIndexPage.tsx b/adminSiteClient/SiteRedirectsIndexPage.tsx
@@ -81,6 +81,10 @@ export default function SiteRedirectsIndexPage() {
         if (value === source) {
             return "Source and target cannot be the same."
         }
+        const sourceUrl = new URL(source, "https://ourworldindata.org")
+        if (sourceUrl.pathname === "/") {
+            return "Source cannot be the root."
+        }
         return undefined
     }
 

diff --git a/adminSiteServer/apiRouter.ts b/adminSiteServer/apiRouter.ts
@@ -1555,6 +1555,9 @@ postRouteWithRWTransaction(
     "/site-redirects/new",
     async (req: Request, res, trx) => {
         const { source, target } = req.body
+        const sourceAsUrl = new URL(source, "https://ourworldindata.org")
+        if (sourceAsUrl.pathname === "/")
+            throw new JsonError("Cannot redirect from /", 400)
         if (await redirectWithSourceExists(trx, source)) {
             throw new JsonError(
                 `Redirect with source ${source} already exists`,