froxlor Subdomain Redirect URL Injection

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs.

Authenticated customers can inject arbitrary nginx or Apache configuration directives, leading to web server configuration corruption, denial of service, or response hijacking across hosted domains.