-
@@ -100,11 +99,6 @@
- {{-- Inline CSS for the spinner animation (no Alpine/external deps) --}}
-
-
{{-- Inline JS — no external dependencies. Reads ?return= for the redirect target.
Polls /up every 2500 ms; requires 2 consecutive 200s before redirecting (flap guard).
Times out after 10 minutes and shows a manual-reload prompt. --}}
@@ -113,13 +107,8 @@
'use strict';
// ── Return URL ─────────────────────────────────────────────────────────
- // Sanitise to a same-origin relative path: must start with a single /,
- // must NOT start with //, http, or contain backslashes.
- var raw = new URLSearchParams(window.location.search).get('return') || '';
- var returnUrl = '/';
- if (raw && /^\/[^\/\\]/.test(raw) && !/^\/\//g.test(raw) && !/^https?:/i.test(raw)) {
- returnUrl = raw;
- }
+ // Server-validated path from the route handler (defence-in-depth guard).
+ var returnUrl = {{ \Illuminate\Support\Js::from($returnPath) }};
// ── Phase timing heuristic (purely visual) ─────────────────────────────
// Approx durations (seconds) per phase before advancing the highlight.
diff --git a/routes/web.php b/routes/web.php
index 090fe7f..5c72fed 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -110,6 +110,11 @@ Route::middleware('auth')->group(function () {
// Plain Blade view — deliberately NOT a Livewire component so it survives the
// container teardown that follows an update request (R1/R2 exception, by design).
- Route::get('/update-progress', fn () => view('update-progress'))->name('update.progress');
+ Route::get('/update-progress', function (Request $request) {
+ $parsed = parse_url((string) $request->query('return', ''), PHP_URL_PATH);
+ $return = (is_string($parsed) && str_starts_with($parsed, '/') && ! str_starts_with($parsed, '//')) ? $parsed : '/';
+
+ return view('update-progress', ['returnPath' => $return]);
+ })->name('update.progress');
});
});