@@ -300,7 +300,7 class ApplicationController < ActionController::Base | |||
|
300 | 300 | end |
|
301 | 301 | |
|
302 | 302 | def redirect_back_or_default(default) |
|
303 | back_url = params[:back_url].to_s | |
|
303 | back_url = CGI.unescape(params[:back_url].to_s) | |
|
304 | 304 | if !back_url.blank? |
|
305 | 305 | begin |
|
306 | 306 | uri = URI.parse(back_url) |
@@ -174,7 +174,7 class UsersController < ApplicationController | |||
|
174 | 174 | def destroy |
|
175 | 175 | @user.destroy |
|
176 | 176 | respond_to do |format| |
|
177 |
format.html { redirect_ |
|
|
177 | format.html { redirect_to_referer_or(users_url) } | |
|
178 | 178 | format.api { render_api_ok } |
|
179 | 179 | end |
|
180 | 180 | end |
@@ -46,7 +46,7 | |||
|
46 | 46 | <td class="last_login_on" align="center"><%= format_time(user.last_login_on) unless user.last_login_on.nil? %></td> |
|
47 | 47 | <td class="buttons"> |
|
48 | 48 | <%= change_status_link(user) %> |
|
49 |
<%= delete_link user_path(user |
|
|
49 | <%= delete_link user_path(user) unless User.current == user %> | |
|
50 | 50 | </td> |
|
51 | 51 | </tr> |
|
52 | 52 | <% end -%> |
@@ -33,12 +33,12 class AccountControllerTest < ActionController::TestCase | |||
|
33 | 33 | |
|
34 | 34 | def test_login_should_redirect_to_back_url_param |
|
35 | 35 | # request.uri is "test.host" in test environment |
|
36 |
post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http |
|
|
36 | post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.host%2Fissues%2Fshow%2F1' | |
|
37 | 37 | assert_redirected_to '/issues/show/1' |
|
38 | 38 | end |
|
39 | 39 | |
|
40 | 40 | def test_login_should_not_redirect_to_another_host |
|
41 |
post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http |
|
|
41 | post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.foo%2Ffake' | |
|
42 | 42 | assert_redirected_to '/my/page' |
|
43 | 43 | end |
|
44 | 44 |
General Comments 0
You need to be logged in to leave comments.
Login now