Merge 8384683 into 5a958e4

.rubocop.yml

@@ -109,6 +109,8 @@ Metrics/BlockNesting:
 Metrics/ClassLength:
   CountComments: false
   Max: 132 # TODO: Lower to 100
+  Exclude:
+    - "lib/rails_admin/config.rb"
 
 Metrics/CyclomaticComplexity:
   Max: 15 # TODO: Lower to 6

app/controllers/rails_admin/main_controller.rb

@@ -56,7 +56,7 @@ def respond_to_missing?(sym, include_private)
     end
 
     def back_or_index
-      params[:return_to].presence && params[:return_to].include?(request.host) && (params[:return_to] != request.fullpath) ? params[:return_to] : index_path
+      params[:return_to].presence && params[:return_to].starts_with?(request.host) && (params[:return_to] != request.fullpath) ? params[:return_to] : index_path
     end
 
     def get_sort_hash(model_config)

spec/controllers/rails_admin/main_controller_spec.rb

@@ -470,4 +470,28 @@ def get(action, params)
       )
     end
   end
+
+  describe 'back_or_index' do
+    before do
+      allow(controller).to receive(:index_path).and_return(index_path)
+    end
+
+    let(:index_path) { '/' }
+
+    it 'returns back to index when return_to is not defined' do
+      controller.params = {}
+      expect(controller.send(:back_or_index)).to eq(index_path)
+    end
+
+    it 'returns back to return_to url when return_path does start_with the request.host' do
+      return_to_url = "#{request.host}/teams"
+      controller.params = {return_to: return_to_url}
+      expect(controller.send(:back_or_index)).to eq(return_to_url)
+    end
+
+    it 'returns back to index when return_path does not start_with the request.host' do
+      controller.params = {return_to: "https://google.com?#{request.host}"}
+      expect(controller.send(:back_or_index)).to eq(index_path)
+    end
+  end
 end