Restrict post-login redirection targets to local URLs

2013-06-26 12:11:06 -04:00
parent 1566e260bd
commit 0f768d144a
1 changed files with 2 additions and 1 deletions
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -7,7 +7,8 @@ class SessionsController < ApplicationController
    session_creator = SessionCreator.new(session, cookies, params[:name], params[:password], params[:remember])

    if session_creator.authenticate
-      redirect_to(params[:url] || session[:previous_uri] || posts_path, :notice => "You are now logged in.")
+      url = params[:url] if params[:url].start_with? '/'
+      redirect_to(url || session[:previous_uri] || posts_path, :notice => "You are now logged in.")
    else
      redirect_to(new_session_path, :notice => "Password was incorrect.")
    end