Add trustedCallbackEdit checks during callback redirect
-->
<%@page import="org.apache.axis2.context.ConfigurationContext"%>
-<%@page import="org.apache.commons.lang.StringUtils" %>
<%@page import="org.owasp.encoder.Encode" %>
<%@ page import="org.wso2.carbon.CarbonConstants" %>
<%@ page import="org.wso2.carbon.identity.application.common.model.idp.xsd.IdentityProvider" %>
String BUNDLE = "org.wso2.carbon.idp.mgt.ui.i18n.Resources";
ResourceBundle resourceBundle = ResourceBundle.getBundle(BUNDLE, request.getLocale());
String callback = request.getParameter("callback");
- if (StringUtils.isBlank(callback) || !IdentityValidationUtil
- .isValidOverBlackListPatterns(callback, IdentityValidationUtil.ValidatorPattern.URI_RESERVED_EXISTS
- .name())) {
+
+ final String trustedCallbackEdit = "idp-mgt-edit.jsp";
+
+ if (!IdentityValidationUtil.isValidOverBlackListPatterns(callback,
+ IdentityValidationUtil.ValidatorPattern.URI_RESERVED_EXISTS.name())
+ || !trustedCallbackEdit.equals(callback)) {
callback = "idp-mgt-list.jsp";
}
try {
