Nemcio/Redmine
1
0
Fork 0
mirror of https://github.com/redmine/redmine.git synced 2025-11-01 19:05:51 +01:00
Code Issues Packages Projects Releases Activity

Don't redirect to another suburi (#16530).

Browse Source 
git-svn-id: http://svn.redmine.org/redmine/trunk@13213 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2014-07-05 09:02:38 +00:00
parent 1b01a7ab5e
commit 0125ba14f6
2 changed files with 67 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
test/functional/account_controller_test.rb
View File

@@ -71,6 +71,22 @@ class AccountControllerTest < ActionController::TestCase
end
end
def test_login_with_suburi_should_redirect_to_back_url_param
@relative_url_root = ApplicationController.relative_url_root
ApplicationController.relative_url_root = '/redmine'
back_urls = [
'http://test.host/redmine/issues/show/1',
'/redmine'
]
back_urls.each do |back_url|
post :login, :username => 'jsmith', :password => 'jsmith', :back_url => back_url
assert_redirected_to back_url
end
ensure
ApplicationController.relative_url_root = @relative_url_root
end
def test_login_should_not_redirect_to_another_host
back_urls = [
'http://test.foo/fake',
@@ -82,6 +98,26 @@ class AccountControllerTest < ActionController::TestCase
end
end
def test_login_with_suburi_should_not_redirect_to_another_suburi
@relative_url_root = ApplicationController.relative_url_root
ApplicationController.relative_url_root = '/redmine'
back_urls = [
'http://test.host/',
'http://test.host/fake',
'http://test.host/fake/issues',
'http://test.host/redmine/../fake',
'http://test.host/redmine/../fake/issues',
'http://test.host/redmine/%2e%2e/fake'
]
back_urls.each do |back_url|
post :login, :username => 'jsmith', :password => 'jsmith', :back_url => back_url
assert_redirected_to '/my/page'
end
ensure
ApplicationController.relative_url_root = @relative_url_root
end
def test_login_with_wrong_password
post :login, :username => 'admin', :password => 'bad'
assert_response :success