Resolve "Kurz-URLs können auf externe URLs verweisen"

Closes #6148

Merge request studip/studip!4663

1 files changed, 4 insertions, 0 deletions

diff --git a/lib/classes/JsonApi/Routes/ShortUrls/ShortUrlCreate.php b/lib/classes/JsonApi/Routes/ShortUrls/ShortUrlCreate.php
index ea51cc8..0f9f151 100644
--- a/lib/classes/JsonApi/Routes/ShortUrls/ShortUrlCreate.php
+++ b/lib/classes/JsonApi/Routes/ShortUrls/ShortUrlCreate.php
@@ -55,6 +55,10 @@ final class ShortUrlCreate extends JsonApiController
             return 'No url for the short-url defined';
         }
 
+        if (!is_internal_url($json['data']['attributes']['path'])) {
+            return 'The target must not be an external URL';
+        }
+
         if (!trim(self::arrayGet($json, 'data.attributes.alias'))) {
             return 'No alias for the short-url defined';
         }