js: Only load URLs prefixed by the base URL

(cherry picked from commit aad020511f12ad5c2dfd9859a52b1c8618be198d)

public/js/icinga/loader.js

@@ -221,6 +221,10 @@
         loadUrl: function (url, $target, data, method, action, autorefresh, progressTimer, extraHeaders) {
             var id = null;
 
+            if (url.startsWith('//') || ! url.startsWith(this.baseUrl + '/')) {
+                throw new Error('URL ' + url + ' is not relative to ' + this.baseUrl);
+            }
+
             // Default method is GET
             if ('undefined' === typeof method) {
                 method = 'GET';