Fix: unvalidated redirect

1 files changed, 4 insertions, 1 deletions

diff --git a/app/Http/RequestHandlers/AddSpouseToIndividualAction.php b/app/Http/RequestHandlers/AddSpouseToIndividualAction.php
index 705b72834d..e9e2547f1e 100644
--- a/app/Http/RequestHandlers/AddSpouseToIndividualAction.php
+++ b/app/Http/RequestHandlers/AddSpouseToIndividualAction.php
@@ -88,6 +88,9 @@ class AddSpouseToIndividualAction implements RequestHandlerInterface
         // Link the spouse to the family
         $spouse->createFact('1 FAMS @' . $family->xref() . '@', false);
 
-        return redirect($params['url'] ?? $spouse->url());
+        $base_url = $request->getAttribute('base_url');
+        $url      = str_starts_with($params['url'], $base_url) ? $params['url'] : $spouse->url();
+
+        return redirect($url);
     }
 }