diff --git a/src/Web/Grand.Web/Controllers/CommonController.cs b/src/Web/Grand.Web/Controllers/CommonController.cs index 9c4d14b15..8b385a0d5 100644 --- a/src/Web/Grand.Web/Controllers/CommonController.cs +++ b/src/Web/Grand.Web/Controllers/CommonController.cs @@ -266,10 +266,11 @@ public virtual async Task SetStore( } //prevent open redirection attack - if (!Url.IsLocalUrl(returnUrl)) - returnUrl = Url.RouteUrl("HomePage"); + var redirectUrl = Url.RouteUrl("HomePage"); + if (Url.IsLocalUrl(returnUrl)) + redirectUrl = returnUrl; - return Redirect(returnUrl); + return Redirect(redirectUrl); void SetStoreCookie(Domain.Stores.Store store) {