From: Jean-Philippe Lang Date: Sun, 2 Feb 2020 08:39:22 +0000 (+0000) Subject: Validate back_url everywhere (#32850). X-Git-Tag: 4.2.0~1222 X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=0cd14b3a4bdcd740f98fb4deb8afd71974888a40;p=redmine.git Validate back_url everywhere (#32850). Patch by Holger Just. git-svn-id: http://svn.redmine.org/redmine/trunk@19488 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index e0ea88553..1559affce 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -428,9 +428,8 @@ class ApplicationController < ActionController::Base helper_method :back_url def redirect_back_or_default(default, options={}) - back_url = params[:back_url].to_s - if back_url.present? && valid_url = validate_back_url(back_url) - redirect_to(valid_url) + if back_url = validate_back_url(params[:back_url].to_s) + redirect_to(back_url) return elsif options[:referer] redirect_to_referer_or default @@ -443,6 +442,8 @@ class ApplicationController < ActionController::Base # Returns a validated URL string if back_url is a valid url for redirection, # otherwise false def validate_back_url(back_url) + return false if back_url.blank? + if CGI.unescape(back_url).include?('..') return false end diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb index 6a7812e4a..9fb6a56c2 100644 --- a/app/helpers/application_helper.rb +++ b/app/helpers/application_helper.rb @@ -1426,12 +1426,12 @@ module ApplicationHelper end def back_url_hidden_field_tag - url = back_url + url = validate_back_url(back_url) hidden_field_tag('back_url', url, :id => nil) unless url.blank? end def cancel_button_tag(fallback_url) - url = back_url.blank? ? fallback_url : back_url + url = validate_back_url(back_url) || fallback_url link_to l(:button_cancel), url end diff --git a/test/functional/timelog_controller_test.rb b/test/functional/timelog_controller_test.rb index 3c14e8e7b..f1764b7c9 100644 --- a/test/functional/timelog_controller_test.rb +++ b/test/functional/timelog_controller_test.rb @@ -173,6 +173,19 @@ class TimelogControllerTest < Redmine::ControllerTest assert_select 'select[name=?]', 'time_entry[project_id]' end + def test_get_edit_should_validate_back_url + @request.session[:user_id] = 2 + + get :edit, :params => {:id => 2, :project_id => nil, :back_url => '/valid'} + assert_response :success + assert_select 'a[href=?]', '/valid', {:text => 'Cancel'} + + get :edit, :params => {:id => 2, :project_id => nil, :back_url => 'invalid'} + assert_response :success + assert_select 'a[href=?]', 'invalid', {:text => 'Cancel', :count => 0} + assert_select 'a[href=?]', '/projects/ecookbook/time_entries', {:text => 'Cancel'} + end + def test_post_create @request.session[:user_id] = 3 assert_difference 'TimeEntry.count' do