@@ -300,7 +300,7 class ApplicationController < ActionController::Base | |||||
300 | end |
|
300 | end | |
301 |
|
301 | |||
302 | def redirect_back_or_default(default) |
|
302 | def redirect_back_or_default(default) | |
303 | back_url = params[:back_url].to_s |
|
303 | back_url = CGI.unescape(params[:back_url].to_s) | |
304 | if !back_url.blank? |
|
304 | if !back_url.blank? | |
305 | begin |
|
305 | begin | |
306 | uri = URI.parse(back_url) |
|
306 | uri = URI.parse(back_url) |
@@ -174,7 +174,7 class UsersController < ApplicationController | |||||
174 | def destroy |
|
174 | def destroy | |
175 | @user.destroy |
|
175 | @user.destroy | |
176 | respond_to do |format| |
|
176 | respond_to do |format| | |
177 |
format.html { redirect_ |
|
177 | format.html { redirect_to_referer_or(users_url) } | |
178 | format.api { render_api_ok } |
|
178 | format.api { render_api_ok } | |
179 | end |
|
179 | end | |
180 | end |
|
180 | end |
@@ -46,7 +46,7 | |||||
46 | <td class="last_login_on" align="center"><%= format_time(user.last_login_on) unless user.last_login_on.nil? %></td> |
|
46 | <td class="last_login_on" align="center"><%= format_time(user.last_login_on) unless user.last_login_on.nil? %></td> | |
47 | <td class="buttons"> |
|
47 | <td class="buttons"> | |
48 | <%= change_status_link(user) %> |
|
48 | <%= change_status_link(user) %> | |
49 |
<%= delete_link user_path(user |
|
49 | <%= delete_link user_path(user) unless User.current == user %> | |
50 | </td> |
|
50 | </td> | |
51 | </tr> |
|
51 | </tr> | |
52 | <% end -%> |
|
52 | <% end -%> |
@@ -33,12 +33,12 class AccountControllerTest < ActionController::TestCase | |||||
33 |
|
33 | |||
34 | def test_login_should_redirect_to_back_url_param |
|
34 | def test_login_should_redirect_to_back_url_param | |
35 | # request.uri is "test.host" in test environment |
|
35 | # request.uri is "test.host" in test environment | |
36 |
post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http |
|
36 | post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.host%2Fissues%2Fshow%2F1' | |
37 | assert_redirected_to '/issues/show/1' |
|
37 | assert_redirected_to '/issues/show/1' | |
38 | end |
|
38 | end | |
39 |
|
39 | |||
40 | def test_login_should_not_redirect_to_another_host |
|
40 | def test_login_should_not_redirect_to_another_host | |
41 |
post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http |
|
41 | post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.foo%2Ffake' | |
42 | assert_redirected_to '/my/page' |
|
42 | assert_redirected_to '/my/page' | |
43 | end |
|
43 | end | |
44 |
|
44 |
General Comments 0
You need to be logged in to leave comments.
Login now