github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-29 01:31:35 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FEATURE: add a setting to allowlist DiscourseConnect return path domains (#21110)

Browse Source 
* FEATURE: add a setting to allowlist DiscourseConnect return path domains

This commit adds a site setting to allowlist DiscourseConnect return
path domains. The setting needs supports exact domain or wildcard
character (*) to allow for any domain as return path.

* Add more specs to clarify what is allowed in site setting

* Update setting description to explain what is allowed
This commit is contained in:
Arpit Jalan
2023-04-17 22:53:50 +05:30
committed by GitHub
parent 68549fe54e
commit 8405ae7733
5 changed files with 58 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
app/controllers/session_controller.rb
View File

@ -208,7 +208,7 @@ class SessionController < ApplicationController
uri = URI(return_path)
if (uri.hostname == Discourse.current_hostname)
return_path = uri.to_s
elsif !SiteSetting.discourse_connect_allows_all_return_paths
elsif !domain_redirect_allowed?(uri.hostname)
return_path = path("/")
end
rescue StandardError
@ -808,4 +808,12 @@ class SessionController < ApplicationController
Rails.logger.warn("SSO invite redemption failed: #{e}")
raise Invite::RedemptionFailed
end
def domain_redirect_allowed?(hostname)
allowed_domains = SiteSetting.discourse_connect_allowed_redirect_domains
return false if allowed_domains.blank?
return true if allowed_domains.split("|").include?("*")
allowed_domains.split("|").include?(hostname)
end
end