Don't redirect to another suburi (#16530).

git-svn-id: http://svn.redmine.org/redmine/trunk@13213 e93f8b46-1217-0410-a6f0-8f06a7374b81

1 files changed, 36 insertions, 0 deletions

diff --git a/test/functional/account_controller_test.rb b/test/functional/account_controller_test.rb
index 991a8fb72..faf7356ea 100644
--- a/test/functional/account_controller_test.rb
+++ b/test/functional/account_controller_test.rb
@@ -71,6 +71,22 @@ class AccountControllerTest < ActionController::TestCase
     end
   end
 
+  def test_login_with_suburi_should_redirect_to_back_url_param
+    @relative_url_root = ApplicationController.relative_url_root
+    ApplicationController.relative_url_root = '/redmine'
+
+    back_urls = [
+      'http://test.host/redmine/issues/show/1',
+      '/redmine'
+    ]
+    back_urls.each do |back_url|
+      post :login, :username => 'jsmith', :password => 'jsmith', :back_url => back_url
+      assert_redirected_to back_url
+    end
+  ensure
+    ApplicationController.relative_url_root = @relative_url_root
+  end
+
   def test_login_should_not_redirect_to_another_host
     back_urls = [
       'http://test.foo/fake',
@@ -82,6 +98,26 @@ class AccountControllerTest < ActionController::TestCase
     end
   end
 
+  def test_login_with_suburi_should_not_redirect_to_another_suburi
+    @relative_url_root = ApplicationController.relative_url_root
+    ApplicationController.relative_url_root = '/redmine'
+
+    back_urls = [
+      'http://test.host/',
+      'http://test.host/fake',
+      'http://test.host/fake/issues',
+      'http://test.host/redmine/../fake',
+      'http://test.host/redmine/../fake/issues',
+      'http://test.host/redmine/%2e%2e/fake'
+    ]
+    back_urls.each do |back_url|
+      post :login, :username => 'jsmith', :password => 'jsmith', :back_url => back_url
+      assert_redirected_to '/my/page'
+    end
+  ensure
+    ApplicationController.relative_url_root = @relative_url_root
+  end
+
   def test_login_with_wrong_password
     post :login, :username => 'admin', :password => 'bad'
     assert_response :success