From a5ae15c1b831d5636732c68dbcbd321f04b8ef60 Mon Sep 17 00:00:00 2001
From: Thomas Hackl <hackl@data-quest.de>
Date: Fri, 9 Jan 2026 12:43:27 +0100
Subject: =?UTF-8?q?Resolve=20"Kurz-URLs=20k=C3=B6nnen=20auf=20externe=20UR?=
 =?UTF-8?q?Ls=20verweisen"?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #6148

Merge request studip/studip!4663
---
 lib/classes/JsonApi/Routes/ShortUrls/ShortUrlCreate.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/classes/JsonApi/Routes/ShortUrls/ShortUrlCreate.php b/lib/classes/JsonApi/Routes/ShortUrls/ShortUrlCreate.php
index ea51cc8..0f9f151 100644
--- a/lib/classes/JsonApi/Routes/ShortUrls/ShortUrlCreate.php
+++ b/lib/classes/JsonApi/Routes/ShortUrls/ShortUrlCreate.php
@@ -55,6 +55,10 @@ final class ShortUrlCreate extends JsonApiController
             return 'No url for the short-url defined';
         }
 
+        if (!is_internal_url($json['data']['attributes']['path'])) {
+            return 'The target must not be an external URL';
+        }
+
         if (!trim(self::arrayGet($json, 'data.attributes.alias'))) {
             return 'No alias for the short-url defined';
         }
-- 
cgit v1.0