Nemcio/Redmine
1
0
Fork 0
mirror of https://github.com/redmine/redmine.git synced 2025-12-16 05:20:28 +01:00
Code Issues Packages Projects Releases Activity

Validate back_url everywhere (#32850).

Browse Source 
Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@19488 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2020-02-02 08:39:22 +00:00
parent b3cda4fd61
commit 0cd14b3a4b
3 changed files with 19 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/controllers/application_controller.rb
View File

@@ -428,9 +428,8 @@ class ApplicationController < ActionController::Base
helper_method :back_url
def redirect_back_or_default(default, options={})
back_url = params[:back_url].to_s
if back_url.present? && valid_url = validate_back_url(back_url)
redirect_to(valid_url)
if back_url = validate_back_url(params[:back_url].to_s)
redirect_to(back_url)
return
elsif options[:referer]
redirect_to_referer_or default
@@ -443,6 +442,8 @@ class ApplicationController < ActionController::Base
# Returns a validated URL string if back_url is a valid url for redirection,
# otherwise false
def validate_back_url(back_url)
return false if back_url.blank?
if CGI.unescape(back_url).include?('..')
return false
end

4
app/helpers/application_helper.rb
View File

@@ -1426,12 +1426,12 @@ module ApplicationHelper
end
def back_url_hidden_field_tag
url = back_url
url = validate_back_url(back_url)
hidden_field_tag('back_url', url, :id => nil) unless url.blank?
end
def cancel_button_tag(fallback_url)
url = back_url.blank? ? fallback_url : back_url
url = validate_back_url(back_url) || fallback_url
link_to l(:button_cancel), url
end