Nemcio/Redmine
1
0
Fork 0
mirror of https://github.com/redmine/redmine.git synced 2025-11-15 09:46:02 +01:00
Code Issues Packages Projects Releases Activity

Unescape back_url param before calling redirect_to.

Browse Source 
git-svn-id: http://redmine.rubyforge.org/svn/trunk@1893 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2008-09-21 12:45:22 +00:00
parent e1c4659752
commit 8a356baf3e
3 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/controllers/application.rb
View File

@@ -16,6 +16,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
require 'uri'
require 'cgi'
class ApplicationController < ActionController::Base
layout 'base'
@@ -123,7 +124,7 @@ class ApplicationController < ActionController::Base
end
def redirect_back_or_default(default)
back_url = params[:back_url]
back_url = CGI.unescape(params[:back_url].to_s)
if !back_url.blank?
uri = URI.parse(back_url)
# do not redirect user to another host