I have tested this item ? unsuccessfully on 88565bd

com_users works ok but com_modules fails.

Test environment
Beta6-dev of 11 December in Wampserver 3.2.4, PHP 7.4.13

URL
http://joomla4/administrator/index.php?option=com_modules&view=module&layout=edit&id=16&client_id=&return=aHR0cHM6Ly93d3cuYmJjLmNvLnVrL25ld3M=

Stack Trace

•	Stack Traces 2

Laminas\Diactoros\Exception\InvalidArgumentException
in C:\www\joomla4\libraries\vendor\laminas\laminas-diactoros\src\HeaderSecurity.php (line 146)
141.	                'Invalid header value type; must be a string or numeric; received %s',
142.	                (is_object($value) ? get_class($value) : gettype($value))
143.	            ));
144.	        }
145.	        if (! self::isValid($value)) {
146.	            throw new Exception\InvalidArgumentException(sprintf(
147.	                '"%s" is not valid header value',
148.	                $value
149.	            ));
150.	        }
151.	    }
HeaderSecurity::assertValid('500 "http://joomla4/administrator/��i���iZ��)�```

```HeaderSecurity::assertValid('500 "http://joomla4/administrator/��i���iZ��)��ڶ��" is not valid header value')in C:\www\joomla4\libraries\vendor\laminas\laminas-diactoros\src\MessageTrait.php (line 399)
Response->Laminas\Diactoros\{closure}('500 "http://joomla4/administrator/��i���iZ��)��ڶ��" is not valid header value')
array_map(object(Closure), array('500 "http://joomla4/administrator/��i���iZ��)��ڶ��" is not valid header value'))in C:\www\joomla4\libraries\vendor\laminas\laminas-diactoros\src\MessageTrait.php (line 402)
Response->filterHeaderValue(array('500 "http://joomla4/administrator/��i���iZ��)��ڶ��" is not valid header value'))in C:\www\joomla4\libraries\vendor\laminas\laminas-diactoros\src\MessageTrait.php (line 249)
Response->withAddedHeader('Status', '500 "http://joomla4/administrator/��i���iZ��)��ڶ��" is not valid header value')in C:\www\joomla4\libraries\vendor\joomla\application\src\AbstractWebApplication.php (line 573)
AbstractWebApplication->setHeader('status', '500 "http://joomla4/administrator/��i���iZ��)��ڶ��" is not valid header value')in C:\www\joomla4\libraries\src\Document\ErrorDocument.php (line 132)
ErrorDocument->render(false, array('template' => 'atum', 'directory' => 'C:\\www\\joomla4\\administrator\\templates', 'debug' => false, 'csp_nonce' => 'YTJhNGIwNjczYzhjN2M3YTNlMTk2ZWFjN2MxOTQ5OGZkM2YzOThlNDI4ZGU1NzAyNTkyOWMwZjBmZWY3ODUwMmMyYjY2OGU1MDRhMzgwZDA2ZTY1NTdiYmZiZWU1MGRhNjY5MGZiNzM1MWU0M2EzNDA3Y2I2MTA1MjRmMjZiMjI=', 'templateInherits' => ''))in C:\www\joomla4\libraries\src\Error\Renderer\HtmlRenderer.php (line 76)
HtmlRenderer->render(object(InvalidArgumentException))in C:\www\joomla4\libraries\src\Exception\ExceptionHandler.php (line 132)
ExceptionHandler::render(object(InvalidArgumentException))in C:\www\joomla4\libraries\src\Application\CMSApplication.php (line 266)
CMSApplication->execute()in C:\www\joomla4\administrator\includes\app.php (line 63)
require_once('C:\\www\\joomla4\\administrator\\includes\\app.php')in C:\www\joomla4\administrator\index.php (line 36)```

<hr /><sub>This comment was created with the <a href="https://github.com/joomla/jissues">J!Tracker Application</a> at <a href="https://issues.joomla.org/tracker/joomla-cms/31636">issues.joomla.org/tracker/joomla-cms/31636</a>.</sub>

I have tested this item ? unsuccessfully on 88565bd

Manipulate the return parameter and set it to an external URL

1. URL + Close button
   https://localhost/bugtesting1/joomla/administrator/index.php?option=com_users&view=user&layout=edit&id=79&return=http://www.example.com
   Tested: successfully

2. URL + Close button
   https://localhost/bugtesting1/joomla/administrator/index.php?option=com_modules&view=module&layout=edit&id=128&client_id=&return=http://www.example.com
   Tested: unsuccesfully, see comment

See test:

Good catch @wilsonge, thanks!

@sandewt @toivo please re-test the now fixed patch - thank you so much!

I have tested this item ✅ successfully on f7c1219

Joomla! 4.0.0-beta6-dev Development [ Mañana ] 27-October-2020 19:54 GMT

I have tested this item ✅ successfully on f7c1219

Tested successfully in Beta6-dev of 15 December.

RTC

Thanks!