J5.x:Gedragsverandering voor Uri::isInternal voor URL's zonder protocol
From Joomla! Documentation
==Errors reported==
This release for Joomla 5.1.3 and 4.4.7 changed how Uri::isInternal handles URLs without scheme/protocol. That might lead to redirects, that previously worked, to break after the update.
==Versions affected==
This pertains only to Joomla! version(s): 5.1.3, 4.4.7
==What is the cause== The Uri::isInternal method considered URLs containing a valid hostname but not a scheme ("www.example.org") as internal URLs. This behavior caused multiple attack vectors. With this release, the behavior has been changed. URLs containg a valid hostname will only be considered internal if the scheme ("https://") is provided in the method call and the scheme matches the currently used scheme of the request.
==How to fix==
Provide absolute URLs including the scheme/protocol or use relative URLs.