From 1d72f1b437d05269f820a247b653e98e66a1418a Mon Sep 17 00:00:00 2001
From: Shlee <github@shl.ee>
Date: Tue, 11 Aug 2026 22:56:37 +0930
Subject: [PATCH 1/2] Update ApiV1Controller.php

---
 app/Http/Controllers/Api/ApiV1Controller.php | 23 ++++++++++----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/app/Http/Controllers/Api/ApiV1Controller.php b/app/Http/Controllers/Api/ApiV1Controller.php
index f9878281a..43f547e14 100644
--- a/app/Http/Controllers/Api/ApiV1Controller.php
+++ b/app/Http/Controllers/Api/ApiV1Controller.php
@@ -346,22 +346,23 @@ class ApiV1Controller extends Controller
             $website = $request->input('website');
             if ($website != $profile->website) {
                 if ($website) {
-                    if (! strpos($website, '.')) {
+                    // Validate URL scheme FIRST
+                    if (!Str::startsWith($website, ['http://', 'https://'])) {
                         $website = null;
-                    }
-
-                    if ($website && ! strpos($website, '://')) {
-                        $website = 'https://'.$website;
-                    }
+                    } else {
+                        if (!strpos($website, '.')) {
+                            $website = null;
+                        }
 
-                    $host = parse_url($website, PHP_URL_HOST);
+                        $host = parse_url($website, PHP_URL_HOST);
 
-                    $bannedInstances = InstanceService::getBannedDomains();
-                    if (in_array($host, $bannedInstances)) {
-                        $website = null;
+                        $bannedInstances = InstanceService::getBannedDomains();
+                        if (in_array($host, $bannedInstances)) {
+                            $website = null;
+                        }
                     }
                 }
-                $profile->website = $website ? $website : null;
+                $profile->website = $website;
                 $changes = true;
             }
         }

From c2044f77cfdc03e465f1fee13571df6b969c70fb Mon Sep 17 00:00:00 2001
From: Shlee <github@shl.ee>
Date: Tue, 11 Aug 2026 22:57:58 +0930
Subject: [PATCH 2/2] Update AdminUserController.php

---
 app/Http/Controllers/Admin/AdminUserController.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/app/Http/Controllers/Admin/AdminUserController.php b/app/Http/Controllers/Admin/AdminUserController.php
index a8baad2e3..9bb264c6d 100644
--- a/app/Http/Controllers/Admin/AdminUserController.php
+++ b/app/Http/Controllers/Admin/AdminUserController.php
@@ -92,6 +92,10 @@ trait AdminUserController
 
     public function userEditSubmit(Request $request, $id)
     {
+        $this->validate($request, [
+            'website' => 'nullable|url|max:120',
+        ]);
+
         $user = User::findOrFail($id);
         $profile = $user->profile;
         $changed = false;