mirror of
https://github.com/rails/rails.git
synced 2022-11-09 12:12:34 -05:00
661da266b9
[CVE-2020-8185]
39 lines
1.1 KiB
Ruby
39 lines
1.1 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require "erb"
|
|
require "action_dispatch/http/request"
|
|
require "active_support/actionable_error"
|
|
|
|
module ActionDispatch
|
|
class ActionableExceptions # :nodoc:
|
|
cattr_accessor :endpoint, default: "/rails/actions"
|
|
|
|
def initialize(app)
|
|
@app = app
|
|
end
|
|
|
|
def call(env)
|
|
request = ActionDispatch::Request.new(env)
|
|
return @app.call(env) unless actionable_request?(request)
|
|
|
|
ActiveSupport::ActionableError.dispatch(request.params[:error].to_s.safe_constantize, request.params[:action])
|
|
|
|
redirect_to request.params[:location]
|
|
end
|
|
|
|
private
|
|
def actionable_request?(request)
|
|
request.get_header("action_dispatch.show_detailed_exceptions") && request.post? && request.path == endpoint
|
|
end
|
|
|
|
def redirect_to(location)
|
|
body = "<html><body>You are being <a href=\"#{ERB::Util.unwrapped_html_escape(location)}\">redirected</a>.</body></html>"
|
|
|
|
[302, {
|
|
"Content-Type" => "text/html; charset=#{Response.default_charset}",
|
|
"Content-Length" => body.bytesize.to_s,
|
|
"Location" => location,
|
|
}, [body]]
|
|
end
|
|
end
|
|
end
|