end
def redirect_back_or_default(default)
- back_url = params[:back_url].to_s
+ back_url = CGI.unescape(params[:back_url].to_s)
if !back_url.blank?
begin
uri = URI.parse(back_url)
<td class="last_login_on" align="center"><%= format_time(user.last_login_on) unless user.last_login_on.nil? %></td>
<td class="buttons">
<%= change_status_link(user) %>
- <%= delete_link user_path(user, :back_url => users_path(params)) unless User.current == user %>
+ <%= delete_link user_path(user) unless User.current == user %>
</td>
</tr>
<% end -%>
def test_login_should_redirect_to_back_url_param
# request.uri is "test.host" in test environment
- post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http://test.host/issues/show/1'
+ post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.host%2Fissues%2Fshow%2F1'
assert_redirected_to '/issues/show/1'
end
def test_login_should_not_redirect_to_another_host
- post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http://test.foo/fake'
+ post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.foo%2Ffake'
assert_redirected_to '/my/page'
end