Merge pull request #12594 from abpframework/auto-merge/rel-5-3/1060

Merge branch dev with rel-5.3

docs/en/Road-Map.md

@@ -4,15 +4,18 @@ This document provides a road map, release schedule and planned features for the
 
 ## Next Versions
 
-### v5.3
+### v5.4
 
-In [5.3 milestone](https://github.com/abpframework/abp/milestone/65), we will be mostly working on the following topics:
+In [5.4 milestone](https://github.com/abpframework/abp/milestone/67), we will be mostly working on the following topics:
 
+* Providing an OpenIddict integration to replace current IdentityServer4 integration.
 * Maturing and documenting the [eShopOnAbp](https://github.com/abpframework/eShopOnAbp) project, writing a free e-book that explains the solution.
 * Working on the [LeptonX](https://blog.abp.io/abp/LeptonX-Theme-for-ABP-Framework-Alpha-Release) theme and making it as the default theme for the ABP Framework UI options.
-* Working on more examples and guides.
+* Improvements on the existing features and providing more guides.
 
-The planned release date for v5.3 is **May, 2022**.
+The planned release date for v5.4 is **July, 2022**.
+
+> After the version 5.4, we will be working for 6.0 which will be released in the end of 2022 based on .NET 7.0.
 
 ## Backlog Items
 
@@ -20,8 +23,8 @@ The *Next Versions* section above shows the main focus of the planned versions.
 
 Here, a list of major items in the backlog we are considering to work on in the next versions.
 
-* [#7221](https://github.com/abpframework/abp/issues/7221) / Alternative to IdentityServer4
 * [#2183](https://github.com/abpframework/abp/issues/2183) / Dapr integration
+* [#6655](https://github.com/abpframework/abp/pull/6655) / Use Typescript for the MVC UI
 * [#236](https://github.com/abpframework/abp/issues/236) / Resource based authorization system
 * [#2882](https://github.com/abpframework/abp/issues/2882) / Providing a gRPC integration infrastructure (while it is [already possible](https://github.com/abpframework/abp-samples/tree/master/GrpcDemo) to create or consume gRPC endpoints for your application, we plan to create endpoints for the [standard application modules](https://docs.abp.io/en/abp/latest/Modules/Index))
 * [#1754](https://github.com/abpframework/abp/issues/1754) / Multi-lingual entities
@@ -31,7 +34,6 @@ Here, a list of major items in the backlog we are considering to work on in the
 * [#4223](https://github.com/abpframework/abp/issues/4223) / WebHook system
 * [#162](https://github.com/abpframework/abp/issues/162) / Azure ElasticDB Integration for multitenancy
 * [#2296](https://github.com/abpframework/abp/issues/2296) / Feature toggling infrastructure
-* [#6655](https://github.com/abpframework/abp/pull/6655) / Use Typescript for the MVC UI
 
 You can always check the milestone planning and the prioritized backlog issues on [the GitHub repository](https://github.com/abpframework/abp/milestones) for a detailed road map. The backlog items are subject to change. We are adding new items and changing priorities based on the community feedbacks and goals of the project.
 

framework/src/Volo.Abp.UI.Navigation/Volo/Abp/Ui/Navigation/Urls/AppUrlProvider.cs

@@ -45,7 +45,7 @@ public class AppUrlProvider : IAppUrlProvider, ITransientDependency
 
     public bool IsRedirectAllowedUrl(string url)
     {
-        var allow = Options.RedirectAllowedUrls.Any(url.StartsWith);
+        var allow = Options.RedirectAllowedUrls.Any(x => url.StartsWith(x, StringComparison.CurrentCultureIgnoreCase));
         if (!allow)
         {
             Logger.LogError($"Invalid RedirectUrl: {url}, Use {nameof(AppUrlProvider)} to configure it!");

modules/account/src/Volo.Abp.Account.Web/Pages/Account/Manage.cshtml.cs

@@ -1,5 +1,7 @@
-using System.ComponentModel.DataAnnotations;
+using System;
+using System.ComponentModel.DataAnnotations;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http.Extensions;
 using Volo.Abp.Identity;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Options;
@@ -32,6 +34,13 @@ public class ManageModel : AccountPageModel
             await contributor.ConfigureAsync(ProfileManagementPageCreationContext);
         }
 
+        if (!Url.IsLocalUrl(ReturnUrl) &&
+            !ReturnUrl.StartsWith(UriHelper.BuildAbsolute(Request.Scheme, Request.Host, Request.PathBase).RemovePostFix("/")) &&
+            !AppUrlProvider.IsRedirectAllowedUrl(ReturnUrl))
+        {
+            ReturnUrl = null;
+        }
+
         return Page();
     }