Post-fix redirect

system/pages/account/manage.php

@@ -21,6 +21,12 @@ if(!$logged) {
 if(isset($_REQUEST['redirect']))
 {
 	$redirect = urldecode($_REQUEST['redirect']);
+	
+	// should never happen, unless hacker modify the URL
+	if (!str_contains($redirect, BASE_URL)) {
+		error('Fatal error: Cannot redirect outside the website.');
+		return;
+	}
 
 	$twig->display('account.redirect.html.twig', array(
 		'redirect' => $redirect