Patch by Holger Just. git-svn-id: http://svn.redmine.org/redmine/trunk@19488 e93f8b46-1217-0410-a6f0-8f06a7374b81tags/4.2.0
@@ -428,9 +428,8 @@ class ApplicationController < ActionController::Base | |||
helper_method :back_url | |||
def redirect_back_or_default(default, options={}) | |||
back_url = params[:back_url].to_s | |||
if back_url.present? && valid_url = validate_back_url(back_url) | |||
redirect_to(valid_url) | |||
if back_url = validate_back_url(params[:back_url].to_s) | |||
redirect_to(back_url) | |||
return | |||
elsif options[:referer] | |||
redirect_to_referer_or default | |||
@@ -443,6 +442,8 @@ class ApplicationController < ActionController::Base | |||
# Returns a validated URL string if back_url is a valid url for redirection, | |||
# otherwise false | |||
def validate_back_url(back_url) | |||
return false if back_url.blank? | |||
if CGI.unescape(back_url).include?('..') | |||
return false | |||
end |
@@ -1426,12 +1426,12 @@ module ApplicationHelper | |||
end | |||
def back_url_hidden_field_tag | |||
url = back_url | |||
url = validate_back_url(back_url) | |||
hidden_field_tag('back_url', url, :id => nil) unless url.blank? | |||
end | |||
def cancel_button_tag(fallback_url) | |||
url = back_url.blank? ? fallback_url : back_url | |||
url = validate_back_url(back_url) || fallback_url | |||
link_to l(:button_cancel), url | |||
end | |||
@@ -173,6 +173,19 @@ class TimelogControllerTest < Redmine::ControllerTest | |||
assert_select 'select[name=?]', 'time_entry[project_id]' | |||
end | |||
def test_get_edit_should_validate_back_url | |||
@request.session[:user_id] = 2 | |||
get :edit, :params => {:id => 2, :project_id => nil, :back_url => '/valid'} | |||
assert_response :success | |||
assert_select 'a[href=?]', '/valid', {:text => 'Cancel'} | |||
get :edit, :params => {:id => 2, :project_id => nil, :back_url => 'invalid'} | |||
assert_response :success | |||
assert_select 'a[href=?]', 'invalid', {:text => 'Cancel', :count => 0} | |||
assert_select 'a[href=?]', '/projects/ecookbook/time_entries', {:text => 'Cancel'} | |||
end | |||
def test_post_create | |||
@request.session[:user_id] = 3 | |||
assert_difference 'TimeEntry.count' do |