From 9b5905f67eaec094ab18f3e22913dd0613342a08 Mon Sep 17 00:00:00 2001
From: Mark Thomas <markt@apache.org>
Date: Tue, 22 Aug 2023 12:31:23 -0600
Subject: [PATCH 1/2] Avoid protocol relative redirects

---
 .../apache/catalina/authenticator/FormAuthenticator.java    | 6 ++++++
 webapps/docs/changelog.xml                                  | 3 +++
 2 files changed, 9 insertions(+)

diff --git a/java/org/apache/catalina/authenticator/FormAuthenticator.java b/java/org/apache/catalina/authenticator/FormAuthenticator.java
index 4a90f5b4008d..5feb53db8989 100644
--- a/java/org/apache/catalina/authenticator/FormAuthenticator.java
+++ b/java/org/apache/catalina/authenticator/FormAuthenticator.java
@@ -733,6 +733,12 @@ protected String savedRequestURL(Session session) {
             sb.append('?');
             sb.append(saved.getQueryString());
         }
+
+        // Avoid protocol relative redirects
+        while (sb.length() > 1 && sb.charAt(1) == '/') {
+            sb.deleteCharAt(0);
+        }
+
         return sb.toString();
     }
 }
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index affe91299c5c..67bdde886522 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -142,6 +142,9 @@
         <code>RemoteIpFilter</code> determines that this request was submitted
         via a secure channel. (lihan)
       </fix>
+      <fix>
+        Avoid protocol relative redirects in FORM authentication. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Web applications">

From 6a7a5d0a306bf458822d95815ad1539abc51c4b6 Mon Sep 17 00:00:00 2001
From: Cesar Hernandez <cfhernan123@gmail.com>
Date: Tue, 5 Sep 2023 16:28:59 -0600
Subject: [PATCH 2/2] Prepare for release 7.0.109-TT.9

---
 build.properties.default | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.properties.default b/build.properties.default
index 659dce584c74..6bab3387e797 100644
--- a/build.properties.default
+++ b/build.properties.default
@@ -27,7 +27,7 @@ version.major=7
 version.minor=0
 version.build=109
 version.patch=0
-version.suffix=-TT.8
+version.suffix=-TT.9
 
 # ----- Source control flags -----
 git.branch=7.0.x