Gallery is still vulnerable to Cross-site Scripting attacks

Hello, After testing out the updates to CVS for Gallery, I realized it is still vulnerable to the cross-site scripting attacks that was mentioned in the first advisory. The following code was committed to CVS: / Test for relative URL, which we know to be local. If URL contains :// assume that it'...