kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Merge pull request #35054 from bogdanvlviv/exercise-redirect_back

Browse source 
Ensure that `redirect_back` with `fallback_location` to another host is allowed
This commit is contained in:
Ryuta Kamizono 2019-01-26 10:14:07 +09:00 committed by GitHub
commit d05bfa6e37
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 29 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
actionpack/test/controller/redirect_test.rb
View file

@ -68,10 +68,18 @@ class RedirectController < ActionController::Base
redirect_back(fallback_location: "/things/stuff", status: 307)
end
def redirect_back_with_status_and_fallback_location_to_another_host
redirect_back(fallback_location: "http://www.rubyonrails.org/", status: 307)
end
def safe_redirect_back_with_status
redirect_back(fallback_location: "/things/stuff", status: 307, allow_other_host: false)
end
def safe_redirect_back_with_status_and_fallback_location_to_another_host
redirect_back(fallback_location: "http://www.rubyonrails.org/", status: 307, allow_other_host: false)
end
def host_redirect
redirect_to action: "other_host", only_path: false, host: "other.test.host"
end
@ -280,6 +288,13 @@ class RedirectTest < ActionController::TestCase
assert_equal "http://test.host/things/stuff", redirect_to_url
end
def test_redirect_back_with_no_referer_redirects_to_another_host
get :redirect_back_with_status_and_fallback_location_to_another_host
assert_response 307
assert_equal "http://www.rubyonrails.org/", redirect_to_url
end
def test_safe_redirect_back_from_other_host
@request.env["HTTP_REFERER"] = "http://another.host/coming/from"
get :safe_redirect_back_with_status
@ -297,6 +312,20 @@ class RedirectTest < ActionController::TestCase
assert_equal referer, redirect_to_url
end
def test_safe_redirect_back_with_no_referer
get :safe_redirect_back_with_status
assert_response 307
assert_equal "http://test.host/things/stuff", redirect_to_url
end
def test_safe_redirect_back_with_no_referer_redirects_to_another_host
get :safe_redirect_back_with_status_and_fallback_location_to_another_host
assert_response 307
assert_equal "http://www.rubyonrails.org/", redirect_to_url
end
def test_redirect_to_record
with_routing do |set|
set.draw do