jro_apps/redmine Commit - r1891:8a356baf3e32

Unescape back_url param before calling redirect_to....

Jean-Philippe Lang -

r1891:8a356baf3e32

parent child

Context file:

r1891:8a356baf3e32

Collapse all files

app/controllers/application.rb +2 -1

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'uri'
+            require 'cgi'
             class ApplicationController < ActionController::Base
               layout 'base'
               before_filter :user_setup, :check_if_login_required, :set_localization
               filter_parameter_logging :password
               include Redmine::MenuManager::MenuController
               helper Redmine::MenuManager::MenuHelper
               REDMINE_SUPPORTED_SCM.each do |scm|
                 require_dependency "repository/#{scm.underscore}"
               end
               def current_role
                 @current_role ||= User.current.role_for_project(@project)
               end
               def user_setup
                 # Check the settings cache for each request
                 Setting.check_cache
                 # Find the current user
                 User.current = find_current_user
               end
               # Returns the current user or nil if no user is logged in
               def find_current_user
                 if session[:user_id]
                   # existing session
                   (User.find_active(session[:user_id]) rescue nil)
                 elsif cookies[:autologin] && Setting.autologin?
                   # auto-login feature
                   User.find_by_autologin_key(cookies[:autologin])
                 elsif params[:key] && accept_key_auth_actions.include?(params[:action])
                   # RSS key authentication
                   User.find_by_rss_key(params[:key])
                 end
               end
               # check if login is globally required to access the application
               def check_if_login_required
                 # no check needed if user is already logged in
                 return true if User.current.logged?
                 require_login if Setting.login_required?
               end
               def set_localization
                 User.current.language = nil unless User.current.logged?
                 lang = begin
                   if !User.current.language.blank? && GLoc.valid_language?(User.current.language)
                     User.current.language
                   elsif request.env['HTTP_ACCEPT_LANGUAGE']
                     accept_lang = parse_qvalues(request.env['HTTP_ACCEPT_LANGUAGE']).first.downcase
                     if !accept_lang.blank? && (GLoc.valid_language?(accept_lang) || GLoc.valid_language?(accept_lang = accept_lang.split('-').first))
                       User.current.language = accept_lang
                     end
                   end
                 rescue
                   nil
                 end || Setting.default_language
                 set_language_if_valid(lang)
               end
               def require_login
                 if !User.current.logged?
                   redirect_to :controller => "account", :action => "login", :back_url => (request.relative_url_root + request.request_uri)
                   return false
                 end
                 true
               end
               def require_admin
                 return unless require_login
                 if !User.current.admin?
                   render_403
                   return false
                 end
                 true
               end
               def deny_access
                 User.current.logged? ? render_403 : require_login
               end
               # Authorize the user for the requested action
               def authorize(ctrl = params[:controller], action = params[:action])
                 allowed = User.current.allowed_to?({:controller => ctrl, :action => action}, @project)
                 allowed ? true : deny_access
               end
               # make sure that the user is a member of the project (or admin) if project is private
               # used as a before_filter for actions that do not require any particular permission on the project
               def check_project_privacy
                 if @project && @project.active?
                   if @project.is_public? || User.current.member_of?(@project) || User.current.admin?
                     true
                   else
                     User.current.logged? ? render_403 : require_login
                   end
                 else
                   @project = nil
                   render_404
                   false
                 end
               end
               def redirect_back_or_default(default)
-                back_url = params[:back_url]
+                back_url = CGI.unescape(params[:back_url].to_s)
                 if !back_url.blank?
                   uri = URI.parse(back_url)
                   # do not redirect user to another host
                   if uri.relative? || (uri.host == request.host)
                     redirect_to(back_url) and return
                   end
                 end
                 redirect_to default
               end
               def render_403
                 @project = nil
                 render :template => "common/403", :layout => !request.xhr?, :status => 403
                 return false
               end
               def render_404
                 render :template => "common/404", :layout => !request.xhr?, :status => 404
                 return false
               end
               def render_error(msg)
                 flash.now[:error] = msg
                 render :nothing => true, :layout => !request.xhr?, :status => 500
               end
               def render_feed(items, options={})
                 @items = items || []
                 @items.sort! {|x,y| y.event_datetime <=> x.event_datetime }
                 @items = @items.slice(0, Setting.feeds_limit.to_i)
                 @title = options[:title] || Setting.app_title
                 render :template => "common/feed.atom.rxml", :layout => false, :content_type => 'application/atom+xml'
               end
               def self.accept_key_auth(*actions)
                 actions = actions.flatten.map(&:to_s)
                 write_inheritable_attribute('accept_key_auth_actions', actions)
               end
               def accept_key_auth_actions
                 self.class.read_inheritable_attribute('accept_key_auth_actions') || []
               end
               # TODO: move to model
               def attach_files(obj, attachments)
                 attached = []
                 if attachments && attachments.is_a?(Hash)
                   attachments.each_value do |attachment|
                     file = attachment['file']
                     next unless file && file.size > 0
                     a = Attachment.create(:container => obj,
                                           :file => file,
                                           :description => attachment['description'].to_s.strip,
                                           :author => User.current)
                     attached << a unless a.new_record?
                   end
                 end
                 attached
               end
               # Returns the number of objects that should be displayed
               # on the paginated list
               def per_page_option
                 per_page = nil
                 if params[:per_page] && Setting.per_page_options_array.include?(params[:per_page].to_s.to_i)
                   per_page = params[:per_page].to_s.to_i
                   session[:per_page] = per_page
                 elsif session[:per_page]
                   per_page = session[:per_page]
                 else
                   per_page = Setting.per_page_options_array.first || 25
                 end
                 per_page
               end
               # qvalues http header parser
               # code taken from webrick
               def parse_qvalues(value)
                 tmp = []
                 if value
                   parts = value.split(/,\s*/)
                   parts.each {|part|
                     if m = %r{^([^\s,]+?)(?:;\s*q=(\d+(?:\.\d+)?))?$}.match(part)
                       val = m[1]
                       q = (m[2] or 1).to_f
                       tmp.push([val, q])
                     end
                   }
                   tmp = tmp.sort_by{|val, q| -q}
                   tmp.collect!{|val, q| val}
                 end
                 return tmp
               end
               # Returns a string that can be used as filename value in Content-Disposition header
               def filename_for_content_disposition(name)
                 request.env['HTTP_USER_AGENT'] =~ %r{MSIE} ? ERB::Util.url_encode(name) : name
               end
             end

app/controllers/timelog_controller.rb +1 -1

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class TimelogController < ApplicationController
               menu_item :issues
               before_filter :find_project, :authorize, :only => [:edit, :destroy]
               before_filter :find_optional_project, :only => [:report, :details]
               verify :method => :post, :only => :destroy, :redirect_to => { :action => :details }
               helper :sort
               include SortHelper
               helper :issues
               include TimelogHelper
               helper :custom_fields
               include CustomFieldsHelper
               def report
                 @available_criterias = { 'project' => {:sql => "#{TimeEntry.table_name}.project_id",
                                                       :klass => Project,
                                                       :label => :label_project},
                                          'version' => {:sql => "#{Issue.table_name}.fixed_version_id",
                                                       :klass => Version,
                                                       :label => :label_version},
                                          'category' => {:sql => "#{Issue.table_name}.category_id",
                                                         :klass => IssueCategory,
                                                         :label => :field_category},
                                          'member' => {:sql => "#{TimeEntry.table_name}.user_id",
                                                      :klass => User,
                                                      :label => :label_member},
                                          'tracker' => {:sql => "#{Issue.table_name}.tracker_id",
                                                       :klass => Tracker,
                                                       :label => :label_tracker},
                                          'activity' => {:sql => "#{TimeEntry.table_name}.activity_id",
                                                        :klass => Enumeration,
                                                        :label => :label_activity},
                                          'issue' => {:sql => "#{TimeEntry.table_name}.issue_id",
                                                      :klass => Issue,
                                                      :label => :label_issue}
                                        }
                 # Add list and boolean custom fields as available criterias
                 custom_fields = (@project.nil? ? IssueCustomField.for_all : @project.all_issue_custom_fields)
                 custom_fields.select {|cf| %w(list bool).include? cf.field_format }.each do |cf|
                   @available_criterias["cf_#{cf.id}"] = {:sql => "(SELECT c.value FROM #{CustomValue.table_name} c WHERE c.custom_field_id = #{cf.id} AND c.customized_type = 'Issue' AND c.customized_id = #{Issue.table_name}.id)",
                                                          :format => cf.field_format,
                                                          :label => cf.name}
                 end if @project
                 # Add list and boolean time entry custom fields
                 TimeEntryCustomField.find(:all).select {|cf| %w(list bool).include? cf.field_format }.each do |cf|
                   @available_criterias["cf_#{cf.id}"] = {:sql => "(SELECT c.value FROM #{CustomValue.table_name} c WHERE c.custom_field_id = #{cf.id} AND c.customized_type = 'TimeEntry' AND c.customized_id = #{TimeEntry.table_name}.id)",
                                                          :format => cf.field_format,
                                                          :label => cf.name}
                 end
                 @criterias = params[:criterias] || []
                 @criterias = @criterias.select{|criteria| @available_criterias.has_key? criteria}
                 @criterias.uniq!
                 @criterias = @criterias[0,3]
                 @columns = (params[:columns] && %w(year month week day).include?(params[:columns])) ? params[:columns] : 'month'
                 retrieve_date_range
                 unless @criterias.empty?
                   sql_select = @criterias.collect{|criteria| @available_criterias[criteria][:sql] + " AS " + criteria}.join(', ')
                   sql_group_by = @criterias.collect{|criteria| @available_criterias[criteria][:sql]}.join(', ')
                   sql = "SELECT #{sql_select}, tyear, tmonth, tweek, spent_on, SUM(hours) AS hours"
                   sql << " FROM #{TimeEntry.table_name}"
                   sql << " LEFT JOIN #{Issue.table_name} ON #{TimeEntry.table_name}.issue_id = #{Issue.table_name}.id"
                   sql << " LEFT JOIN #{Project.table_name} ON #{TimeEntry.table_name}.project_id = #{Project.table_name}.id"
                   sql << " WHERE"
                   sql << " (%s) AND" % @project.project_condition(Setting.display_subprojects_issues?) if @project
                   sql << " (%s) AND" % Project.allowed_to_condition(User.current, :view_time_entries)
                   sql << " (spent_on BETWEEN '%s' AND '%s')" % [ActiveRecord::Base.connection.quoted_date(@from.to_time), ActiveRecord::Base.connection.quoted_date(@to.to_time)]
                   sql << " GROUP BY #{sql_group_by}, tyear, tmonth, tweek, spent_on"
                   @hours = ActiveRecord::Base.connection.select_all(sql)
                   @hours.each do |row|
                     case @columns
                     when 'year'
                       row['year'] = row['tyear']
                     when 'month'
                       row['month'] = "#{row['tyear']}-#{row['tmonth']}"
                     when 'week'
                       row['week'] = "#{row['tyear']}-#{row['tweek']}"
                     when 'day'
                       row['day'] = "#{row['spent_on']}"
                     end
                   end
                   @total_hours = @hours.inject(0) {|s,k| s = s + k['hours'].to_f}
                   @periods = []
                   # Date#at_beginning_of_ not supported in Rails 1.2.x
                   date_from = @from.to_time
                   # 100 columns max
                   while date_from <= @to.to_time && @periods.length < 100
                     case @columns
                     when 'year'
                       @periods << "#{date_from.year}"
                       date_from = (date_from + 1.year).at_beginning_of_year
                     when 'month'
                       @periods << "#{date_from.year}-#{date_from.month}"
                       date_from = (date_from + 1.month).at_beginning_of_month
                     when 'week'
                       @periods << "#{date_from.year}-#{date_from.to_date.cweek}"
                       date_from = (date_from + 7.day).at_beginning_of_week
                     when 'day'
                       @periods << "#{date_from.to_date}"
                       date_from = date_from + 1.day
                     end
                   end
                 end
                 respond_to do |format|
                   format.html { render :layout => !request.xhr? }
                   format.csv  { send_data(report_to_csv(@criterias, @periods, @hours).read, :type => 'text/csv; header=present', :filename => 'timelog.csv') }
                 end
               end
               def details
                 sort_init 'spent_on', 'desc'
                 sort_update
                 cond = ARCondition.new
                 if @project.nil?
                   cond << Project.allowed_to_condition(User.current, :view_time_entries)
                 elsif @issue.nil?
                   cond << @project.project_condition(Setting.display_subprojects_issues?)
                 else
                   cond << ["#{TimeEntry.table_name}.issue_id = ?", @issue.id]
                 end
                 retrieve_date_range
                 cond << ['spent_on BETWEEN ? AND ?', @from, @to]
                 TimeEntry.visible_by(User.current) do
                   respond_to do |format|
                     format.html {
                       # Paginate results
                       @entry_count = TimeEntry.count(:include => :project, :conditions => cond.conditions)
                       @entry_pages = Paginator.new self, @entry_count, per_page_option, params['page']
                       @entries = TimeEntry.find(:all,
                                                 :include => [:project, :activity, :user, {:issue => :tracker}],
                                                 :conditions => cond.conditions,
                                                 :order => sort_clause,
                                                 :limit  =>  @entry_pages.items_per_page,
                                                 :offset =>  @entry_pages.current.offset)
                       @total_hours = TimeEntry.sum(:hours, :include => :project, :conditions => cond.conditions).to_f
                       render :layout => !request.xhr?
                     }
                     format.atom {
                       entries = TimeEntry.find(:all,
                                                :include => [:project, :activity, :user, {:issue => :tracker}],
                                                :conditions => cond.conditions,
                                                :order => "#{TimeEntry.table_name}.created_on DESC",
                                                :limit => Setting.feeds_limit.to_i)
                       render_feed(entries, :title => l(:label_spent_time))
                     }
                     format.csv {
                       # Export all entries
                       @entries = TimeEntry.find(:all,
                                                 :include => [:project, :activity, :user, {:issue => [:tracker, :assigned_to, :priority]}],
                                                 :conditions => cond.conditions,
                                                 :order => sort_clause)
                       send_data(entries_to_csv(@entries).read, :type => 'text/csv; header=present', :filename => 'timelog.csv')
                     }
                   end
                 end
               end
               def edit
                 render_403 and return if @time_entry && !@time_entry.editable_by?(User.current)
                 @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => Date.today)
                 @time_entry.attributes = params[:time_entry]
                 if request.post? and @time_entry.save
                   flash[:notice] = l(:notice_successful_update)
-                  redirect_to(params[:back_url].blank? ? {:action => 'details', :project_id => @time_entry.project} : params[:back_url])
+                  redirect_back_or_default :action => 'details', :project_id => @time_entry.project
                   return
                 end
               end
               def destroy
                 render_404 and return unless @time_entry
                 render_403 and return unless @time_entry.editable_by?(User.current)
                 @time_entry.destroy
                 flash[:notice] = l(:notice_successful_delete)
                 redirect_to :back
               rescue ::ActionController::RedirectBackError
                 redirect_to :action => 'details', :project_id => @time_entry.project
               end
             private
               def find_project
                 if params[:id]
                   @time_entry = TimeEntry.find(params[:id])
                   @project = @time_entry.project
                 elsif params[:issue_id]
                   @issue = Issue.find(params[:issue_id])
                   @project = @issue.project
                 elsif params[:project_id]
                   @project = Project.find(params[:project_id])
                 else
                   render_404
                   return false
                 end
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_optional_project
                 if !params[:issue_id].blank?
                   @issue = Issue.find(params[:issue_id])
                   @project = @issue.project
                 elsif !params[:project_id].blank?
                   @project = Project.find(params[:project_id])
                 end
                 deny_access unless User.current.allowed_to?(:view_time_entries, @project, :global => true)
               end
               # Retrieves the date range based on predefined ranges or specific from/to param dates
               def retrieve_date_range
                 @free_period = false
                 @from, @to = nil, nil
                 if params[:period_type] == '1' || (params[:period_type].nil? && !params[:period].nil?)
                   case params[:period].to_s
                   when 'today'
                     @from = @to = Date.today
                   when 'yesterday'
                     @from = @to = Date.today - 1
                   when 'current_week'
                     @from = Date.today - (Date.today.cwday - 1)%7
                     @to = @from + 6
                   when 'last_week'
                     @from = Date.today - 7 - (Date.today.cwday - 1)%7
                     @to = @from + 6
                   when '7_days'
                     @from = Date.today - 7
                     @to = Date.today
                   when 'current_month'
                     @from = Date.civil(Date.today.year, Date.today.month, 1)
                     @to = (@from >> 1) - 1
                   when 'last_month'
                     @from = Date.civil(Date.today.year, Date.today.month, 1) << 1
                     @to = (@from >> 1) - 1
                   when '30_days'
                     @from = Date.today - 30
                     @to = Date.today
                   when 'current_year'
                     @from = Date.civil(Date.today.year, 1, 1)
                     @to = Date.civil(Date.today.year, 12, 31)
                   end
                 elsif params[:period_type] == '2' || (params[:period_type].nil? && (!params[:from].nil? || !params[:to].nil?))
                   begin; @from = params[:from].to_s.to_date unless params[:from].blank?; rescue; end
                   begin; @to = params[:to].to_s.to_date unless params[:to].blank?; rescue; end
                   @free_period = true
                 else
                   # default
                 end
                 @from, @to = @to, @from if @from && @to && @from > @to
                 @from ||= (TimeEntry.minimum(:spent_on, :include => :project, :conditions => Project.allowed_to_condition(User.current, :view_time_entries)) || Date.today) - 1
                 @to   ||= (TimeEntry.maximum(:spent_on, :include => :project, :conditions => Project.allowed_to_condition(User.current, :view_time_entries)) || Date.today)
               end
             end

test/functional/account_controller_test.rb +2 -2

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.dirname(__FILE__) + '/../test_helper'
             require 'account_controller'
             # Re-raise errors caught by the controller.
             class AccountController; def rescue_action(e) raise e end; end
             class AccountControllerTest < Test::Unit::TestCase
               fixtures :users
               def setup
                 @controller = AccountController.new
                 @request    = ActionController::TestRequest.new
                 @response   = ActionController::TestResponse.new
                 User.current = nil
               end
               def test_show
                 get :show, :id => 2
                 assert_response :success
                 assert_template 'show'
                 assert_not_nil assigns(:user)
               end
               def test_show_inactive
                 get :show, :id => 5
                 assert_response 404
                 assert_nil assigns(:user)
               end
               def test_login_should_redirect_to_back_url_param
                 # request.uri is "test.host" in test environment
-                post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http://test.host/issues/show/1'
+                post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.host%2Fissues%2Fshow%2F1'
                 assert_redirected_to '/issues/show/1'
               end
               def test_login_should_not_redirect_to_another_host
-                post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http://test.foo/fake'
+                post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.foo%2Ffake'
                 assert_redirected_to '/my/page'
               end
               def test_login_with_wrong_password
                 post :login, :username => 'admin', :password => 'bad'
                 assert_response :success
                 assert_template 'login'
                 assert_tag 'div',
                            :attributes => { :class => "flash error" },
                            :content => /Invalid user or password/
               end
               def test_autologin
                 Setting.autologin = "7"
                 Token.delete_all
                 post :login, :username => 'admin', :password => 'admin', :autologin => 1
                 assert_redirected_to 'my/page'
                 token = Token.find :first
                 assert_not_nil token
                 assert_equal User.find_by_login('admin'), token.user
                 assert_equal 'autologin', token.action
               end
               def test_logout
                 @request.session[:user_id] = 2
                 get :logout
                 assert_redirected_to ''
                 assert_nil @request.session[:user_id]
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages