github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-24 14:12:10 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: StaticController#enter should not redirect to invalid paths (#27913)

Browse Source 
This commit updates `StaticController#enter` to not redirect to invalid
paths when the `redirect` param is set. Instead it should redirect to `/` when the
`redirect` param is invalid.
This commit is contained in:
Alan Guo Xiang Tan
2024-07-15 14:39:37 +08:00
committed by GitHub
parent 5f4dc1042e
commit a3d319ac2f
2 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
app/controllers/static_controller.rb
View File

@ -133,7 +133,8 @@ class StaticController < ApplicationController
forum_uri = URI(Discourse.base_url)
uri = URI(redirect_location)
if uri.path.present? && (uri.host.blank? || uri.host == forum_uri.host) && uri.path !~ /\./
if uri.path.present? && (uri.host.blank? || uri.host == forum_uri.host) &&
uri.path =~ %r{\A\/{1}[^\.\s]*\z}
destination = "#{uri.path}#{uri.query ? "?#{uri.query}" : ""}"
end
rescue URI::Error
@ -141,7 +142,7 @@ class StaticController < ApplicationController
end
end
redirect_to destination
redirect_to(destination, allow_other_host: false)
end
FAVICON ||= -"favicon"