Redmine

I have confirmed that the changes below fix this problem.

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 06e2d702c1..afbb30f3ee 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -440,7 +440,7 @@ class ApplicationController < ActionController::Base
     end

     begin
-      uri = URI.parse(back_url)
+      uri = URI.parse(URI.encode(back_url))
     rescue URI::InvalidURIError
       return false
     end

However, I am concerned that this change will cause other problems.
ApplicationController#validate_back_url is a method that includes security changes(#19577), so it needs to be corrected carefully.