summaryrefslogtreecommitdiffstats
path: root/app/controllers/application_controller.rb
diff options
context:
space:
mode:
authorJean-Philippe Lang <jp_lang@yahoo.fr>2020-02-02 08:39:22 +0000
committerJean-Philippe Lang <jp_lang@yahoo.fr>2020-02-02 08:39:22 +0000
commit0cd14b3a4bdcd740f98fb4deb8afd71974888a40 (patch)
treed53e5ff447772a9427438bed9d3f3724e6f82c8a /app/controllers/application_controller.rb
parentb3cda4fd61913af4a2bb2b6e47354d3e389cbad6 (diff)
downloadredmine-0cd14b3a4bdcd740f98fb4deb8afd71974888a40.tar.gz
redmine-0cd14b3a4bdcd740f98fb4deb8afd71974888a40.zip
Validate back_url everywhere (#32850).
Patch by Holger Just. git-svn-id: http://svn.redmine.org/redmine/trunk@19488 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app/controllers/application_controller.rb')
-rw-r--r--app/controllers/application_controller.rb7
1 files changed, 4 insertions, 3 deletions
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index e0ea88553..1559affce 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -428,9 +428,8 @@ class ApplicationController < ActionController::Base
helper_method :back_url
def redirect_back_or_default(default, options={})
- back_url = params[:back_url].to_s
- if back_url.present? && valid_url = validate_back_url(back_url)
- redirect_to(valid_url)
+ if back_url = validate_back_url(params[:back_url].to_s)
+ redirect_to(back_url)
return
elsif options[:referer]
redirect_to_referer_or default
@@ -443,6 +442,8 @@ class ApplicationController < ActionController::Base
# Returns a validated URL string if back_url is a valid url for redirection,
# otherwise false
def validate_back_url(back_url)
+ return false if back_url.blank?
+
if CGI.unescape(back_url).include?('..')
return false
end