jro_apps/redmine Commit - r1891:8a356baf3e32

Unescape back_url param before calling redirect_to....

Jean-Philippe Lang -

r1891:8a356baf3e32

parent child

Context file:

r1891:8a356baf3e32

app/controllers/application.rb +2 -1

             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'uri'
+            require 'cgi'
             class ApplicationController < ActionController::Base
               layout 'base'
               end
               def redirect_back_or_default(default)
-                back_url = params[:back_url]
+                back_url = CGI.unescape(params[:back_url].to_s)
                 if !back_url.blank?
                   uri = URI.parse(back_url)
                   # do not redirect user to another host

app/controllers/timelog_controller.rb +1 -1

                 @time_entry.attributes = params[:time_entry]
                 if request.post? and @time_entry.save
                   flash[:notice] = l(:notice_successful_update)
-                  redirect_to(params[:back_url].blank? ? {:action => 'details', :project_id => @time_entry.project} : params[:back_url])
+                  redirect_back_or_default :action => 'details', :project_id => @time_entry.project
                   return
                 end
               end

test/functional/account_controller_test.rb +2 -2

               def test_login_should_redirect_to_back_url_param
                 # request.uri is "test.host" in test environment
-                post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http://test.host/issues/show/1'
+                post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.host%2Fissues%2Fshow%2F1'
                 assert_redirected_to '/issues/show/1'
               end
               def test_login_should_not_redirect_to_another_host
-                post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http://test.foo/fake'
+                post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.foo%2Ffake'
                 assert_redirected_to '/my/page'
               end

General Comments 0

You need to be logged in to leave comments. Login now

No TODOs yet

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages