David Leadbeater 69378eac99
Don't allow URLs that contain non-normalized paths to be verified (#20999)
* Don't allow URLs that contain non-normalized paths to be verified

This stops things like https://example.com/otheruser/../realuser where
"/otheruser" appears to be the verified URL, but the actual URL being
verified is "/realuser" due to the "/../".

Also fix a test to use 'https', so it is testing the right thing, now
that since #20304 https is required.

* missing do
2022-11-20 19:28:13 +01:00
..
2022-02-22 20:14:17 +01:00
2022-11-08 17:32:03 +01:00
2022-02-14 21:27:53 +01:00
2018-10-04 12:36:53 +02:00
2017-06-19 11:31:37 +02:00
2018-10-04 12:36:53 +02:00
2018-10-04 12:36:53 +02:00
2020-06-02 19:24:53 +02:00
2017-06-19 01:38:50 +02:00
2020-10-12 16:33:49 +02:00
2018-10-04 12:36:53 +02:00
2018-10-04 12:36:53 +02:00
2017-04-05 00:29:56 +02:00
2018-10-04 12:36:53 +02:00
2020-06-02 19:24:53 +02:00
2019-03-03 22:18:23 +01:00
2018-10-04 12:36:53 +02:00
2021-02-21 19:50:12 +01:00
2020-06-02 19:24:53 +02:00