upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-04-15 22:11:17 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 26

Fix absolute redirect

Browse source 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
This commit is contained in:
John Molakvoæ (skjnldsv) 2020-04-10 08:50:15 +02:00 committed by backportbot[bot]
parent 7d412b5733
commit 8d72a2adef
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
core/Controller/LoginController.php
View file

@ -253,7 +253,7 @@ class LoginController extends Controller {
private function generateRedirect(?string $redirectUrl): RedirectResponse {
if ($redirectUrl !== null && $this->userSession->isLoggedIn()) {
$location = $this->urlGenerator->getAbsoluteURL(urldecode($redirectUrl));
$location = $this->urlGenerator->getAbsoluteURL($redirectUrl);
// Deny the redirect if the URL contains a @
// This prevents unvalidated redirects like ?redirect_url=:user@domain.com
if (strpos($location, '@') === false) {

6
tests/Core/Controller/LoginControllerTest.php
View file

@ -503,7 +503,7 @@ class LoginControllerTest extends TestCase {
->method('getUID')
->will($this->returnValue('jane'));
$password = 'secret';
$originalUrl = 'another%20url';
$originalUrl = 'another url';
$redirectUrl = 'http://localhost/another url';
$this->request
@ -545,7 +545,7 @@ class LoginControllerTest extends TestCase {
$this->request,
$user,
$password,
'%2Fapps%2Fmail'
'/apps/mail'
);
$loginResult = LoginResult::success($loginData);
$this->chain->expects($this->once())
@ -561,7 +561,7 @@ class LoginControllerTest extends TestCase {
->will($this->returnValue($redirectUrl));
$expected = new \OCP\AppFramework\Http\RedirectResponse($redirectUrl);
$response = $this->loginController->tryLogin($user, $password, '%2Fapps%2Fmail');
$response = $this->loginController->tryLogin($user, $password, '/apps/mail');
$this->assertEquals($expected, $response);
}