Unescape back_url param before calling redirect_to.

git-svn-id: http://redmine.rubyforge.org/svn/trunk@1893 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/app/controllers/application.rb b/app/controllers/application.rb
index 795c50d4bd544a2b4b58ff083b8e0bc3be6dd19f..238239c440c4c72f9506bd9d36f9cc32fcc91a30 100644 (file)
--- a/app/controllers/application.rb
+++ b/app/controllers/application.rb
@@ -16,6 +16,7 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 require 'uri'
+require 'cgi'
 
 class ApplicationController < ActionController::Base
   layout 'base'
@@ -123,7 +124,7 @@ class ApplicationController < ActionController::Base
   end
 
   def redirect_back_or_default(default)
-    back_url = params[:back_url]
+    back_url = CGI.unescape(params[:back_url].to_s)
     if !back_url.blank?
       uri = URI.parse(back_url)
       # do not redirect user to another host

diff --git a/app/controllers/timelog_controller.rb b/app/controllers/timelog_controller.rb
index 897a50fe54145cfe5e4a0268116e4c6d7f83a0c8..c333c02bb0a5a61589fd989307306e6e6c524049 100644 (file)
--- a/app/controllers/timelog_controller.rb
+++ b/app/controllers/timelog_controller.rb
@@ -194,7 +194,7 @@ class TimelogController < ApplicationController
     @time_entry.attributes = params[:time_entry]
     if request.post? and @time_entry.save
       flash[:notice] = l(:notice_successful_update)
-      redirect_to(params[:back_url].blank? ? {:action => 'details', :project_id => @time_entry.project} : params[:back_url])
+      redirect_back_or_default :action => 'details', :project_id => @time_entry.project
       return
     end    
   end

diff --git a/test/functional/account_controller_test.rb b/test/functional/account_controller_test.rb
index 26218d177bdfda6038f424e5556e8e96ec793d98..a6e3799916cbbf86c034e6d8303fc3052bd68814 100644 (file)
--- a/test/functional/account_controller_test.rb
+++ b/test/functional/account_controller_test.rb
@@ -46,12 +46,12 @@ class AccountControllerTest < Test::Unit::TestCase
   
   def test_login_should_redirect_to_back_url_param
     # request.uri is "test.host" in test environment
-    post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http://test.host/issues/show/1'
+    post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.host%2Fissues%2Fshow%2F1'
     assert_redirected_to '/issues/show/1'
   end
   
   def test_login_should_not_redirect_to_another_host
-    post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http://test.foo/fake'
+    post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.foo%2Ffake'
     assert_redirected_to '/my/page'
   end