jaculabilis/danbooru
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Restrict post-login redirection targets to local URLs

Browse Source
This commit is contained in:
Kevin Xiwei Zheng
2013-06-26 12:11:06 -04:00
parent 1566e260bd
commit 0f768d144a
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/controllers/sessions_controller.rb
View File

@@ -7,7 +7,8 @@ class SessionsController < ApplicationController
session_creator = SessionCreator.new(session, cookies, params[:name], params[:password], params[:remember]) session_creator = SessionCreator.new(session, cookies, params[:name], params[:password], params[:remember])
if session_creator.authenticate if session_creator.authenticate
redirect_to(params[:url] || session[:previous_uri] || posts_path, :notice => "You are now logged in.") url = params[:url] if params[:url].start_with? '/'
redirect_to(url || session[:previous_uri] || posts_path, :notice => "You are now logged in.")
else else
redirect_to(new_session_path, :notice => "Password was incorrect.") redirect_to(new_session_path, :notice => "Password was incorrect.")
end end