Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fixed back url verification (#16466).
git-svn-id: http://svn.redmine.org/redmine/trunk@13018 e93f8b46-1217-0410-a6f0-8f06a7374b81
  • Loading branch information
jplang committed Mar 29, 2014
1 parent cecbb22 commit 7567c3d
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 3 deletions.
2 changes: 1 addition & 1 deletion app/controllers/application_controller.rb
Expand Up @@ -379,7 +379,7 @@ def redirect_back_or_default(default, options={})
begin
uri = URI.parse(back_url)
# do not redirect user to another host or to the login or register page
if (uri.relative? || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)})
if ((uri.relative? && back_url.match(%r{\A/\w})) || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)})
redirect_to(back_url)
return
end
Expand Down
10 changes: 8 additions & 2 deletions test/functional/account_controller_test.rb
Expand Up @@ -66,8 +66,14 @@ def test_login_should_redirect_to_back_url_param
end

def test_login_should_not_redirect_to_another_host
post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http://test.foo/fake'
assert_redirected_to '/my/page'
back_urls = [
'http://test.foo/fake',
'//test.foo/fake'
]
back_urls.each do |back_url|
post :login, :username => 'jsmith', :password => 'jsmith', :back_url => back_url
assert_redirected_to '/my/page'
end
end

def test_login_with_wrong_password
Expand Down

0 comments on commit 7567c3d

Please sign in to comment.