Problem/Motivation
When using domain language negotiation the destination parameter can be stripped.
Steps to reproduce:
- Install standard
- Install the language module
- Add second language
- Go to Configuration > Regional and language > Languages > Detection, click on Domain and make up some configuration and save it.
- Visit /admin/structure/block
- Click the seven link in local tasks
- Click remove on the first block
- Click click the remove button
- You should be on admin/structure/block/list/seven but you're on admin/structure/block
This can also cause errors with disabled javascript, domain language negotiation and Big Pipe enabled:
"Symfony\Component\HttpKernel\Exception\HttpException: The original location is missing. Drupal\big_pipe\Controller\BigPipeController->setNoJsCookie() (line 50 /core/modules/big_pipe/src/Controller/BigPipeController.php)"Proposed resolution
Fix the \Drupal\Core\Security\RequestSanitizer to use \Drupal\Component\Utility\UrlHelper::externalIsLocal() to determine is an external URL is really external.
Remaining tasks
User interface changes
None
API changes
None
Data model changes
None
Release notes snippet
N/a