Index: openacs-4/packages/acs-subsite/lib/login.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/lib/login.tcl,v diff -u -r1.28 -r1.29 --- openacs-4/packages/acs-subsite/lib/login.tcl 10 Jan 2007 21:22:05 -0000 1.28 +++ openacs-4/packages/acs-subsite/lib/login.tcl 29 Aug 2008 17:21:40 -0000 1.29 @@ -69,7 +69,9 @@ set system_name [ad_system_name] if { [exists_and_not_null return_url] } { - if {[util_complete_url_p $return_url]} { + if {[util_complete_url_p $return_url] + && ![string match "[string trimright [subsite::get_url -absolute_p 1 -protocol http] /]/*" $return_url] + && ![string match "[string trimright [subsite::get_url -absolute_p 1 -protocol https] /]/*" $return_url]} { ad_returnredirect -message "only urls without a host name are permitted" "." ad_script_abort }