github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-22 22:43:33 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FEATURE: setting to allow arbitrary redirects from sso origin

Browse Source 
if sso_allows_all_return_paths is set to true you can redirect off-site from sso success
This commit is contained in:
Sam
2016-12-16 13:37:44 +11:00
parent 6ff309aa80
commit 61eb134181
4 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
spec/controllers/session_controller_spec.rb
View File

@ -141,6 +141,19 @@ describe SessionController do
expect(response).to redirect_to('/b/')
end
it 'redirects to random url if it is allowed' do
SiteSetting.sso_allows_all_return_paths = true
sso = get_sso('https://gusundtrout.com')
sso.external_id = '666' # the number of the beast
sso.email = 'bob@bob.com'
sso.name = 'Sam Saffron'
sso.username = 'sam'
get :sso_login, Rack::Utils.parse_query(sso.payload)
expect(response).to redirect_to('https://gusundtrout.com')
end
it 'redirects to root if the host of the return_path is different' do
sso = get_sso('//eviltrout.com')
sso.external_id = '666' # the number of the beast