Nemcio/Redmine
1
0
Fork 0
mirror of https://github.com/redmine/redmine.git synced 2026-01-19 14:03:06 +01:00
Code Issues Packages Projects Releases Activity

Merged r23465 from trunk to 6.0-stable (#41930).

Browse Source 
git-svn-id: https://svn.redmine.org/redmine/branches/6.0-stable@23467 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Go MAEDA
2025-01-28 07:49:07 +00:00
parent 13f6cea750
commit 8964c2e7fc
2 changed files with 20 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/controllers/application_controller.rb
View File

@@ -509,11 +509,9 @@ class ApplicationController < ActionController::Base
if uri.send(component).present? && uri.send(component) != request.send(component)
return false
end
uri.send(:"#{component}=", nil)
end
# Always ignore basic user:password in the URL
uri.userinfo = nil
# Remove unnecessary components to convert the URL into a relative URL
uri.omit!(:scheme, :userinfo, :host, :port)
rescue Addressable::URI::InvalidURIError
return false
end

18
test/functional/account_controller_test.rb
View File

@@ -658,4 +658,22 @@ class AccountControllerTest < Redmine::ControllerTest
end
end
end
def test_validate_back_url
request.host = 'example.com'
assert_equal '/admin', @controller.send(:validate_back_url, 'http://example.com/admin')
assert_equal '/admin', @controller.send(:validate_back_url, 'http://dlopper:foo@example.com/admin')
assert_equal '/issues?query_id=1#top', @controller.send(:validate_back_url, 'http://example.com/issues?query_id=1#top')
assert_equal false, @controller.send(:validate_back_url, 'http://invalid.example.com/issues')
end
def test_validate_back_url_with_port
request.host = 'example.com:3000'
assert_equal '/admin', @controller.send(:validate_back_url, 'http://example.com:3000/admin')
assert_equal '/admin', @controller.send(:validate_back_url, 'http://dlopper:foo@example.com:3000/admin')
assert_equal '/issues?query_id=1#top', @controller.send(:validate_back_url, 'http://example.com:3000/issues?query_id=1#top')
assert_equal false, @controller.send(:validate_back_url, 'http://invalid.example.com:3000/issues')
end
end