summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--app/controllers/application_controller.rb7
-rw-r--r--app/helpers/application_helper.rb4
-rw-r--r--test/functional/timelog_controller_test.rb13
3 files changed, 19 insertions, 5 deletions
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index e0ea88553..1559affce 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -428,9 +428,8 @@ class ApplicationController < ActionController::Base
helper_method :back_url
def redirect_back_or_default(default, options={})
- back_url = params[:back_url].to_s
- if back_url.present? && valid_url = validate_back_url(back_url)
- redirect_to(valid_url)
+ if back_url = validate_back_url(params[:back_url].to_s)
+ redirect_to(back_url)
return
elsif options[:referer]
redirect_to_referer_or default
@@ -443,6 +442,8 @@ class ApplicationController < ActionController::Base
# Returns a validated URL string if back_url is a valid url for redirection,
# otherwise false
def validate_back_url(back_url)
+ return false if back_url.blank?
+
if CGI.unescape(back_url).include?('..')
return false
end
diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 6a7812e4a..9fb6a56c2 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -1426,12 +1426,12 @@ module ApplicationHelper
end
def back_url_hidden_field_tag
- url = back_url
+ url = validate_back_url(back_url)
hidden_field_tag('back_url', url, :id => nil) unless url.blank?
end
def cancel_button_tag(fallback_url)
- url = back_url.blank? ? fallback_url : back_url
+ url = validate_back_url(back_url) || fallback_url
link_to l(:button_cancel), url
end
diff --git a/test/functional/timelog_controller_test.rb b/test/functional/timelog_controller_test.rb
index 3c14e8e7b..f1764b7c9 100644
--- a/test/functional/timelog_controller_test.rb
+++ b/test/functional/timelog_controller_test.rb
@@ -173,6 +173,19 @@ class TimelogControllerTest < Redmine::ControllerTest
assert_select 'select[name=?]', 'time_entry[project_id]'
end
+ def test_get_edit_should_validate_back_url
+ @request.session[:user_id] = 2
+
+ get :edit, :params => {:id => 2, :project_id => nil, :back_url => '/valid'}
+ assert_response :success
+ assert_select 'a[href=?]', '/valid', {:text => 'Cancel'}
+
+ get :edit, :params => {:id => 2, :project_id => nil, :back_url => 'invalid'}
+ assert_response :success
+ assert_select 'a[href=?]', 'invalid', {:text => 'Cancel', :count => 0}
+ assert_select 'a[href=?]', '/projects/ecookbook/time_entries', {:text => 'Cancel'}
+ end
+
def test_post_create
@request.session[:user_id] = 3
assert_difference 'TimeEntry.count' do