lib/redmine_omniauth_cas/application_controller_patch.rb
# Returns a validated URL string if back_url is a valid url for redirection,
# otherwise false
Returns a validated URL string if back_url is a valid url for redirection,
otherwise false
Returns a validated URL string if back_url is a valid url for redirection otherwise false
def validate_back_url(back_url)
      return false if back_url.blank?
      if CGI.unescape(back_url).include?('..')
        return false
      end
      begin
        uri = URI.parse(back_url)
      rescue URI::InvalidURIError
        return false
      end
      [:host].each do |component|
        if uri.send(component).present? && uri.send(component) != request.send(component)
          return false
        end
      end
      uri.scheme = nil
      uri.host = nil
      uri.port = nil
      uri.userinfo = nil
      path = uri.to_s
      if path !~ %r{\A/([^/]|\z)}
        return false
      end
      if path.match(%r{/(login|account/register|account/lost_password)})
        return false
      end
      if relative_url_root.present? && !path.starts_with?(relative_url_root)
        return false
      end
      return path
    end
def validate_back_url ( back_url ) return false if back_url . blank? if CGI . unescape ( back_url ) . include? ( '..' ) return false end begin uri = URI . parse ( back_url ) rescue URI :: InvalidURIError return false end [ :host ] . each do | component | if uri . send ( component ) . present? && uri . send ( component ) != request . send ( component ) return false end end uri . scheme = nil uri . host = nil uri . port = nil uri . userinfo = nil path = uri . to_s if path !~ %r{ \A /([^/]| \z ) } return false end if path . match ( %r{ /(login|account/register|account/lost_password) } ) return false end if relative_url_root . present? && ! path . starts_with? ( relative_url_root ) return false end return path end
Returns a validated URL string if back_url is a valid url for redirection,
otherwise false
Returns a validated URL string if back_url is a valid url for redirection otherwise false
## PATCHED : ignore scheme HTTPS/HTTP and port so redirection works behind reverse proxies # Always ignore basic user:password in the URL # Ensure that the remaining URL starts with a slash, followed by a # non-slash character or the end
back_url
<not_specific>