jaculabilis/danbooru
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix #3539: Open redirect vulnerabilities.

Browse Source
This commit is contained in:
evazion
2018-02-07 17:11:52 -06:00
parent 583520b97c
commit 84a0a89f4b
4 changed files with 29 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
app/helpers/posts_helper.rb
View File

@@ -5,13 +5,13 @@ module PostsHelper
def next_page_url
current_page = (params[:page] || 1).to_i
url_for(nav_params.merge(page: current_page + 1)).html_safe
url_for(nav_params_for(current_page + 1)).html_safe
end
def prev_page_url
current_page = (params[:page] || 1).to_i
if current_page >= 2
url_for(nav_params.merge(page: current_page - 1)).html_safe
url_for(nav_params_for(current_page - 1)).html_safe
else
nil
end
@@ -134,7 +134,8 @@ module PostsHelper
private
def nav_params
params.to_unsafe_h # XXX
def nav_params_for(page)
query_params = params.except(:controller, :action, :id).merge(page: page).permit!
{ params: query_params }
end
end