Nemcio/Redmine
1
0
Fork 0
mirror of https://github.com/redmine/redmine.git synced 2025-11-02 11:25:55 +01:00
Code Issues Packages Projects Releases Activity

Validate back_url everywhere (#32850).

Browse Source 
Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@19488 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2020-02-02 08:39:22 +00:00
parent b3cda4fd61
commit 0cd14b3a4b
3 changed files with 19 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/controllers/application_controller.rb
View File

@@ -428,9 +428,8 @@ class ApplicationController < ActionController::Base
helper_method :back_url
def redirect_back_or_default(default, options={})
back_url = params[:back_url].to_s
if back_url.present? && valid_url = validate_back_url(back_url)
redirect_to(valid_url)
if back_url = validate_back_url(params[:back_url].to_s)
redirect_to(back_url)
return
elsif options[:referer]
redirect_to_referer_or default
@@ -443,6 +442,8 @@ class ApplicationController < ActionController::Base
# Returns a validated URL string if back_url is a valid url for redirection,
# otherwise false
def validate_back_url(back_url)
return false if back_url.blank?
if CGI.unescape(back_url).include?('..')
return false
end