c0mrade 424a19344d fix(security): extract & reuse getSafeRedirectPath, plug TopUpAmount returnTo ...

TelegramRedirect already had a local getSafeRedirectUrl helper that
collapsed protocol-relative URLs, absolute URLs, exotic schemes, and
URL-encoded forms down to '/'. TopUpAmount.handleSuccess was navigating
straight to a user-supplied returnTo query param without that filter —
not externally exploitable through react-router's navigate() (it doesn't
trigger an external nav), but a crafted link could produce ugly path
artefacts ('?returnTo=https://evil.com' would land the user at
/balance/top-up/<method>/https://evil.com).

Hoist the helper to src/utils/safeRedirect.ts, rename to
getSafeRedirectPath, reuse it in TelegramRedirect, and wrap TopUpAmount's
returnTo through it before navigate().

2026-05-26 16:13:33 +03:00

..

api-error.ts

fix: handle Pydantic validation errors in notify + nullify empty optional fields

2026-03-06 18:03:27 +03:00

backgroundConfig.ts

fix: resolve all 14 ESLint warnings across the codebase

2026-03-13 20:19:09 +03:00

campaign.ts

fix: resolve telegram auth token expiration and clean up codebase

2026-03-13 17:50:49 +03:00

clipboard.ts

feat: add recharts analytics to admin campaign stats page

2026-03-02 06:10:20 +03:00

colorConversion.ts

refactor: migrate to eslint flat config and format codebase with prettier

2026-01-27 17:37:31 +03:00

colorParser.ts

fix: add light theme support to connection page

2026-02-06 18:30:19 +03:00

connectionLink.ts

fix(connection): happ cryptolink flow + ui fixes (#385)

2026-04-15 03:29:54 +03:00

displayName.ts

fix(dashboard): show full name on welcome, fix gender mismatch on trial-expired card

2026-05-13 09:02:10 +03:00

format.ts

fix(format): convert price by exchange rate on landings and gift page

2026-05-13 04:56:15 +03:00

formatTraffic.ts

refactor: rewrite dashboard components to match prototype design

2026-02-25 10:22:50 +03:00

glassTheme.ts

fix: improve light theme visibility for dashboard and subscription cards

2026-02-28 06:37:40 +03:00

inputHelpers.ts

fix: allow clearing number inputs and add validation

2026-02-02 03:10:54 +03:00

linkify.ts

feat: multi-media attachments, linkify URLs, shared MessageMediaGrid

2026-04-29 08:45:15 +03:00

logger.ts

refactor: full codebase cleanup, dependency updates, and lint fixes

2026-02-06 16:55:55 +03:00

navigation.ts

fix(navigation): make Telegram back button work on deep-link entry

2026-05-22 15:02:56 +03:00

oauth.ts

fix: resolve all 14 ESLint warnings across the codebase

2026-03-13 20:19:09 +03:00

paymentStatus.ts

feat: добавлена поддержка SeverPay в кабинете

2026-03-18 03:49:36 +03:00

rateLimit.ts

refactor: migrate to eslint flat config and format codebase with prettier

2026-01-27 17:37:31 +03:00

referral.ts

fix: resolve telegram auth token expiration and clean up codebase

2026-03-13 17:50:49 +03:00

safeRedirect.ts

fix(security): extract & reuse getSafeRedirectPath, plug TopUpAmount returnTo

2026-05-26 16:13:33 +03:00

subscriptionHelpers.ts

fix(admin): show flag for every country code, not just hardcoded 25-36

2026-05-16 01:11:00 +03:00

templateEngine.ts

feat: convert ConnectionModal to /connection page with crypto deep links

2026-02-05 07:33:45 +03:00

token.ts

feat(auth,a11y): Telegram CloudStorage token recovery + blocking-screen a11y

2026-05-25 23:43:17 +03:00

topUpStorage.ts

fix: resolve telegram auth token expiration and clean up codebase

2026-03-13 17:50:49 +03:00

trafficZone.ts

fix: заменить хардкодный зелёный (#3EDBB0) на акцентный цвет из темы

2026-03-05 10:56:45 +03:00

validation.ts

refactor: full codebase cleanup, dependency updates, and lint fixes

2026-02-06 16:55:55 +03:00

withdrawalUtils.ts

refactor(theming): orange-* → warning-* for promo/highlight semantics

2026-05-26 11:22:19 +03:00

yandexCid.ts

feat: Yandex Metrika CID tracking, offline conversions UI, sticky pay button

2026-04-29 08:59:19 +03:00