Index: openacs-4/packages/bug-tracker/www/map-patch-to-bugs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/bug-tracker/www/map-patch-to-bugs.tcl,v
diff -u -N -r1.12 -r1.13
--- openacs-4/packages/bug-tracker/www/map-patch-to-bugs.tcl	26 Jun 2015 14:47:08 -0000	1.12
+++ openacs-4/packages/bug-tracker/www/map-patch-to-bugs.tcl	29 May 2016 10:50:02 -0000	1.13
@@ -13,9 +13,17 @@
     {offset:integer "0"}
     {interval_size "50"}
     cancel:optional
-    {return_url ""}
+    {return_url:trim,notnull ""}
+} -validate {
+    valid_return_url -requires return_url {
+	# actually, one should use the page filter localurl from OpenACS 5.9
+	if {[util::external_url_p $return_url]} {
+	    ad_complain "invalid return_url"
+	}
+    }
 }
 
+
 set package_id [ad_conn package_id]
 set user_id [ad_conn user_id]
 set redirect_url [ad_decode $return_url "" "patch?patch_number=$patch_number" $return_url]