The admin and reseller login pages redirected to basename($referrer) after a
successful sign-in. basename() only strips forward slashes, and browsers read
`\\evil.com` in a Location header as `//evil.com`, so a link to
/CODE/login?referrer=\\\\\\\\evil.com (backslashes halved twice by the input
cleaner) sent the freshly signed-in admin or reseller to another site.
AdminHelpers::loginRedirectTarget() accepts only what the auth redirects
produce — a page name with an optional plain query string — and falls back
to the dashboard for anything else, logout included.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V2uBUbGApb4A7Rbcoi7dxA
post.php hands its optional `referer` parameter to
AdminHelpers::getPageFromURL() on every edit (streams, movies, created
channels, episodes, lines, MAG, Enigma2, radios, series, resellers). The
new-UI forms post without one, and the `string` type the cs-fix pass
(758a9cab) put on the parameter turned that null into a TypeError: the save
answered an empty 200 and the form showed its error toast. Found by the new
E2E line-edit test.
The function already treated an empty URL as "no page"; it now takes null the
same way, and a URL without a path no longer reads an undefined `path` key.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016WDhDajBPziJwjWZcXnh6R
