diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2014-04-05 08:11:28 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2014-04-05 08:11:28 +0000 |
| commit | 380b0515d11a3450c475ce7f2bbed2bd073d0df5 (patch) | |
| tree | ccaa0da3dbf5bfc619ee521059a330016820933d | |
| parent | e739628c8112f2835bef151ef788e0daf2848ccf (diff) | |
| download | redmine-380b0515d11a3450c475ce7f2bbed2bd073d0df5.tar.gz redmine-380b0515d11a3450c475ce7f2bbed2bd073d0df5.zip | |
Fixed that back_url=/ param is ignored (#16467).
git-svn-id: http://svn.redmine.org/redmine/trunk@13040 e93f8b46-1217-0410-a6f0-8f06a7374b81
| -rw-r--r-- | app/controllers/application_controller.rb | 2 | ||||
| -rw-r--r-- | test/functional/account_controller_test.rb | 10 |
2 files changed, 9 insertions, 3 deletions
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 1e251c2a4..5e5b297c2 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -379,7 +379,7 @@ class ApplicationController < ActionController::Base begin uri = URI.parse(back_url) # do not redirect user to another host or to the login or register page - if ((uri.relative? && back_url.match(%r{\A/\w})) || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)}) + if ((uri.relative? && back_url.match(%r{\A/(\w.*)?\z})) || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)}) redirect_to(back_url) return end diff --git a/test/functional/account_controller_test.rb b/test/functional/account_controller_test.rb index e9156957c..991a8fb72 100644 --- a/test/functional/account_controller_test.rb +++ b/test/functional/account_controller_test.rb @@ -61,8 +61,14 @@ class AccountControllerTest < ActionController::TestCase def test_login_should_redirect_to_back_url_param # request.uri is "test.host" in test environment - post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http://test.host/issues/show/1' - assert_redirected_to '/issues/show/1' + back_urls = [ + 'http://test.host/issues/show/1', + '/' + ] + back_urls.each do |back_url| + post :login, :username => 'jsmith', :password => 'jsmith', :back_url => back_url + assert_redirected_to back_url + end end def test_login_should_not_redirect_to_another_host |