git-svn-id: http://svn.redmine.org/redmine/trunk@13040 e93f8b46-1217-0410-a6f0-8f06a7374b81tags/2.6.0
begin | begin | ||||
uri = URI.parse(back_url) | uri = URI.parse(back_url) | ||||
# do not redirect user to another host or to the login or register page | # do not redirect user to another host or to the login or register page | ||||
if ((uri.relative? && back_url.match(%r{\A/\w})) || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)}) | |||||
if ((uri.relative? && back_url.match(%r{\A/(\w.*)?\z})) || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)}) | |||||
redirect_to(back_url) | redirect_to(back_url) | ||||
return | return | ||||
end | end |
def test_login_should_redirect_to_back_url_param | def test_login_should_redirect_to_back_url_param | ||||
# request.uri is "test.host" in test environment | # request.uri is "test.host" in test environment | ||||
post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http://test.host/issues/show/1' | |||||
assert_redirected_to '/issues/show/1' | |||||
back_urls = [ | |||||
'http://test.host/issues/show/1', | |||||
'/' | |||||
] | |||||
back_urls.each do |back_url| | |||||
post :login, :username => 'jsmith', :password => 'jsmith', :back_url => back_url | |||||
assert_redirected_to back_url | |||||
end | |||||
end | end | ||||
def test_login_should_not_redirect_to_another_host | def test_login_should_not_redirect_to_another_host |