From f48eec2e9355e78e78eff8490793d4cb6d2e8b7a Mon Sep 17 00:00:00 2001
From: "nicolas.dorier" <nicolas.dorier@gmail.com>
Date: Wed, 5 Apr 2023 10:55:35 +0900
Subject: [PATCH] Fix: Redirecting to local absolute URL in wizard windows
 should work

---
 BTCPayServer/Extensions/UrlHelperExtensions.cs           | 2 +-
 BTCPayServer/Views/Shared/ConfirmModal.cshtml            | 2 +-
 BTCPayServer/Views/UIHome/RecoverySeedBackup.cshtml      | 4 ++--
 BTCPayServer/Views/UIWallets/SignWithSeed.cshtml         | 4 ++--
 BTCPayServer/Views/UIWallets/WalletPSBT.cshtml           | 4 ++--
 BTCPayServer/Views/UIWallets/WalletPSBTCombine.cshtml    | 4 ++--
 BTCPayServer/Views/UIWallets/WalletPSBTDecoded.cshtml    | 4 ++--
 BTCPayServer/Views/UIWallets/WalletReceive.cshtml        | 2 +-
 BTCPayServer/Views/UIWallets/WalletSend.cshtml           | 4 ++--
 BTCPayServer/Views/UIWallets/WalletSendVault.cshtml      | 4 ++--
 BTCPayServer/Views/UIWallets/WalletSigningOptions.cshtml | 4 ++--
 11 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/BTCPayServer/Extensions/UrlHelperExtensions.cs b/BTCPayServer/Extensions/UrlHelperExtensions.cs
index 70426808e..4ebd335ae 100644
--- a/BTCPayServer/Extensions/UrlHelperExtensions.cs
+++ b/BTCPayServer/Extensions/UrlHelperExtensions.cs
@@ -18,7 +18,7 @@ namespace Microsoft.AspNetCore.Mvc
                 return url;
             if (httpRequest is null)
                 return null;
-            if (Uri.TryCreate(url, UriKind.Absolute, out var r) && r.Host.Equals(httpRequest.Host.Host))
+            if (Uri.TryCreate(url, UriKind.Absolute, out var r) && r.Host.Equals(httpRequest.Host.Host) && (!httpRequest.IsHttps || r.Scheme == "https"))
                 return url;
             return null;
         }
diff --git a/BTCPayServer/Views/Shared/ConfirmModal.cshtml b/BTCPayServer/Views/Shared/ConfirmModal.cshtml
index 5658f64bf..35a2f33bc 100644
--- a/BTCPayServer/Views/Shared/ConfirmModal.cshtml
+++ b/BTCPayServer/Views/Shared/ConfirmModal.cshtml
@@ -32,7 +32,7 @@
 
         @if (!string.IsNullOrEmpty(Model.Action))
         {
-            <form id="ConfirmForm" method="post" action="@Url.EnsureLocal(actionUrl)" rel="noreferrer noopener">
+			<form id="ConfirmForm" method="post" action="@Url.EnsureLocal(actionUrl, Context.Request)" rel="noreferrer noopener">
                 <div class="modal-body pt-0" id="ConfirmText" hidden>
                     <label for="ConfirmInput" class="form-label">Confirm the action by typing <strong id="ConfirmInputText"></strong>:</label>
                     <input id="ConfirmInput" class="form-control"/>
diff --git a/BTCPayServer/Views/UIHome/RecoverySeedBackup.cshtml b/BTCPayServer/Views/UIHome/RecoverySeedBackup.cshtml
index 2c0423c7a..a39f8d795 100644
--- a/BTCPayServer/Views/UIHome/RecoverySeedBackup.cshtml
+++ b/BTCPayServer/Views/UIHome/RecoverySeedBackup.cshtml
@@ -80,7 +80,7 @@
     </div>
     @if (Model.RequireConfirm)
     {
-        <form id="RecoveryConfirmation" action="@Url.EnsureLocal(Model.ReturnUrl)" class="position-relative d-flex align-items-start justify-content-center" style="padding:20px 0 100px" rel="noreferrer noopener">
+        <form id="RecoveryConfirmation" action="@Url.EnsureLocal(Model.ReturnUrl, Context.Request)" class="position-relative d-flex align-items-start justify-content-center" style="padding:20px 0 100px" rel="noreferrer noopener">
             <label class="form-check-label lead order-2" for="confirm">I have written down my recovery phrase and stored it in a secure location</label>
             <input type="checkbox" class="me-3 order-1 form-check-input" id="confirm" style="margin-top:.35rem;flex-shrink:0">
             <button type="submit" class="btn btn-primary btn-lg px-5 order-3" id="submit">Done</button>
@@ -89,6 +89,6 @@
     }
     else
     {
-        <a href="@Url.EnsureLocal(Model.ReturnUrl)" class="btn btn-primary btn-lg mt-3 px-5 order-3" id="proceed" rel="noreferrer noopener">Done</a>
+        <a href="@Url.EnsureLocal(Model.ReturnUrl, Context.Request)" class="btn btn-primary btn-lg mt-3 px-5 order-3" id="proceed" rel="noreferrer noopener">Done</a>
     }
 </main>
diff --git a/BTCPayServer/Views/UIWallets/SignWithSeed.cshtml b/BTCPayServer/Views/UIWallets/SignWithSeed.cshtml
index bc1e73dda..18ba6cb7b 100644
--- a/BTCPayServer/Views/UIWallets/SignWithSeed.cshtml
+++ b/BTCPayServer/Views/UIWallets/SignWithSeed.cshtml
@@ -11,11 +11,11 @@
 @section Navbar {
     @if (backUrl != null)
     {
-        <a href="@Url.EnsureLocal(backUrl)" id="GoBack">
+		<a href="@Url.EnsureLocal(backUrl, Context.Request)" id="GoBack">
             <vc:icon symbol="back" />
         </a>
     }
-    <a href="@Url.EnsureLocal(cancelUrl)" id="CancelWizard" class="cancel">
+	<a href="@Url.EnsureLocal(cancelUrl, Context.Request)" id="CancelWizard" class="cancel">
         <vc:icon symbol="close" />
     </a>
 }
diff --git a/BTCPayServer/Views/UIWallets/WalletPSBT.cshtml b/BTCPayServer/Views/UIWallets/WalletPSBT.cshtml
index a032a9250..ff97b8b4c 100644
--- a/BTCPayServer/Views/UIWallets/WalletPSBT.cshtml
+++ b/BTCPayServer/Views/UIWallets/WalletPSBT.cshtml
@@ -13,11 +13,11 @@
 @section Navbar {
     @if (backUrl != null)
     {
-        <a href="@Url.EnsureLocal(backUrl)" id="GoBack">
+		<a href="@Url.EnsureLocal(backUrl, Context.Request)" id="GoBack">
             <vc:icon symbol="back" />
         </a>
     }
-    <a href="@Url.EnsureLocal(cancelUrl)" id="CancelWizard" class="cancel">
+	<a href="@Url.EnsureLocal(cancelUrl, Context.Request)" id="CancelWizard" class="cancel">
         <vc:icon symbol="close" />
     </a>
 }
diff --git a/BTCPayServer/Views/UIWallets/WalletPSBTCombine.cshtml b/BTCPayServer/Views/UIWallets/WalletPSBTCombine.cshtml
index cf340e054..ef710edea 100644
--- a/BTCPayServer/Views/UIWallets/WalletPSBTCombine.cshtml
+++ b/BTCPayServer/Views/UIWallets/WalletPSBTCombine.cshtml
@@ -11,11 +11,11 @@
 @section Navbar {
     @if (backUrl != null)
     {
-        <a href="@Url.EnsureLocal(backUrl)" id="GoBack">
+		<a href="@Url.EnsureLocal(backUrl, Context.Request)" id="GoBack">
             <vc:icon symbol="back" />
         </a>
     }
-    <a href="@Url.EnsureLocal(cancelUrl)" id="CancelWizard" class="cancel">
+	<a href="@Url.EnsureLocal(cancelUrl, Context.Request)" id="CancelWizard" class="cancel">
         <vc:icon symbol="close" />
     </a>
 }
diff --git a/BTCPayServer/Views/UIWallets/WalletPSBTDecoded.cshtml b/BTCPayServer/Views/UIWallets/WalletPSBTDecoded.cshtml
index deea9e2d6..c54f6e353 100644
--- a/BTCPayServer/Views/UIWallets/WalletPSBTDecoded.cshtml
+++ b/BTCPayServer/Views/UIWallets/WalletPSBTDecoded.cshtml
@@ -77,11 +77,11 @@
 @section Navbar {
     @if (backUrl != null)
     {
-        <a href="@Url.EnsureLocal(backUrl)" id="GoBack">
+		<a href="@Url.EnsureLocal(backUrl, Context.Request)" id="GoBack">
             <vc:icon symbol="back" />
         </a>
     }
-    <a href="@Url.EnsureLocal(cancelUrl)" id="CancelWizard" class="cancel">
+	<a href="@Url.EnsureLocal(cancelUrl, Context.Request)" id="CancelWizard" class="cancel">
         <vc:icon symbol="close" />
     </a>
 }
diff --git a/BTCPayServer/Views/UIWallets/WalletReceive.cshtml b/BTCPayServer/Views/UIWallets/WalletReceive.cshtml
index 3a9bdec81..42998ee91 100644
--- a/BTCPayServer/Views/UIWallets/WalletReceive.cshtml
+++ b/BTCPayServer/Views/UIWallets/WalletReceive.cshtml
@@ -18,7 +18,7 @@
 }
 
 @section Navbar {
-    <a href="@Url.EnsureLocal(returnUrl)" id="CancelWizard" class="cancel">
+	<a href="@Url.EnsureLocal(returnUrl, Context.Request)" id="CancelWizard" class="cancel">
         <vc:icon symbol="close" />
     </a>
 }
diff --git a/BTCPayServer/Views/UIWallets/WalletSend.cshtml b/BTCPayServer/Views/UIWallets/WalletSend.cshtml
index d7b3acfc9..347300ff0 100644
--- a/BTCPayServer/Views/UIWallets/WalletSend.cshtml
+++ b/BTCPayServer/Views/UIWallets/WalletSend.cshtml
@@ -20,11 +20,11 @@
 @section Navbar {
     @if (backUrl != null)
     {
-        <a href="@Url.EnsureLocal(backUrl)" id="GoBack">
+		<a href="@Url.EnsureLocal(backUrl, Context.Request)" id="GoBack">
             <vc:icon symbol="back" />
         </a>
     }
-    <a href="@Url.EnsureLocal(cancelUrl)" id="CancelWizard" class="cancel">
+	<a href="@Url.EnsureLocal(cancelUrl, Context.Request)" id="CancelWizard" class="cancel">
         <vc:icon symbol="close" />
     </a>
 }
diff --git a/BTCPayServer/Views/UIWallets/WalletSendVault.cshtml b/BTCPayServer/Views/UIWallets/WalletSendVault.cshtml
index 184e34081..88893163e 100644
--- a/BTCPayServer/Views/UIWallets/WalletSendVault.cshtml
+++ b/BTCPayServer/Views/UIWallets/WalletSendVault.cshtml
@@ -11,11 +11,11 @@
 @section Navbar {
     @if (backUrl != null)
     {
-        <a href="@Url.EnsureLocal(backUrl)" id="GoBack">
+		<a href="@Url.EnsureLocal(backUrl, Context.Request)" id="GoBack">
             <vc:icon symbol="back" />
         </a>
     }
-    <a href="@Url.EnsureLocal(cancelUrl)" id="CancelWizard" class="cancel">
+	<a href="@Url.EnsureLocal(cancelUrl, Context.Request)" id="CancelWizard" class="cancel">
         <vc:icon symbol="close" />
     </a>
 }
diff --git a/BTCPayServer/Views/UIWallets/WalletSigningOptions.cshtml b/BTCPayServer/Views/UIWallets/WalletSigningOptions.cshtml
index f3b11e39e..e4dafebc5 100644
--- a/BTCPayServer/Views/UIWallets/WalletSigningOptions.cshtml
+++ b/BTCPayServer/Views/UIWallets/WalletSigningOptions.cshtml
@@ -12,11 +12,11 @@
 @section Navbar {
     @if (backUrl != null)
     {
-        <a href="@Url.EnsureLocal(backUrl)" id="GoBack">
+		<a href="@Url.EnsureLocal(backUrl, Context.Request)" id="GoBack">
             <vc:icon symbol="back" />
         </a>
     }
-    <a href="@Url.EnsureLocal(cancelUrl)" id="CancelWizard" class="cancel">
+	<a href="@Url.EnsureLocal(cancelUrl, Context.Request)" id="CancelWizard" class="cancel">
         <vc:icon symbol="close" />
     </a>
 }