Fix open redirect vulnerability on the login page (#2262)

controllers/route.go

@@ -7,6 +7,7 @@ import (
 	"html/template"
 	"net/http"
 	"net/url"
+	"strings"
 	"time"
 
 	"github.com/NYTimes/gziphandler"
@@ -296,9 +297,9 @@ func (as *AdminServer) nextOrIndex(w http.ResponseWriter, r *http.Request) {
 	next := "/"
 	url, err := url.Parse(r.FormValue("next"))
 	if err == nil {
-		path := url.Path
+		path := url.EscapedPath()
 		if path != "" {
-			next = path
+			next = "/" + strings.TrimLeft(path, "/")
 		}
 	}
 	http.Redirect(w, r, next, http.StatusFound)