gitlab-org--gitlab-foss/app/controllers/concerns/continue_params.rb

# frozen_string_literal: true

module ContinueParams
  include InternalRedirect
  extend ActiveSupport::Concern

  def continue_params
    continue_params = params[:continue]
    return {} unless continue_params

    continue_params = continue_params.permit(:to, :notice, :notice_now)
    continue_params[:to] = safe_redirect_path(continue_params[:to])

    continue_params
  end
end
Enable frozen string in app/controllers/*/.rb Enables frozen string for the following: * app/controllers/.rb app/controllers/admin/*/.rb * app/controllers/boards/*/.rb * app/controllers/ci/*/.rb * app/controllers/concerns/*/.rb Partially addresses #47424. 2018-09-14 01:42:05 -04:00			`# frozen_string_literal: true`

ContinueToParams -> ContinueParams 2016-03-07 04:36:16 -05:00			`module ContinueParams`
Reuses `InternalRedirect` when possible `InternalRedirect` prevents Open redirect issues by only allowing redirection to paths on the same host. It cleans up any unwanted strings from the path that could point to another host (fe. //about.gitlab.com/hello). While preserving the querystring and fragment of the uri. It is already used by: - `TermsController` - `ContinueParams` - `ImportsController` - `ForksController` - `SessionsController`: Only for verifying the host in CE. EE allows redirecting to a different instance using Geo. 2018-05-02 14:25:21 -04:00			`include InternalRedirect`
Check redirect path in the continue_params Fixes https://dev.gitlab.org/gitlab/gitlabhq/issues/2649 https://gitlab.com/gitlab-org/gitlab-ce/issues/13956 2016-03-07 04:06:54 -05:00			`extend ActiveSupport::Concern`

			`def continue_params`
			`continue_params = params[:continue]`
Make checks for continue_params more robust The check for continue_params&.key?(:to) in Projects::ImportsController caused an exception in redirect_to if this key contained a nil value. Since url_for won't add any params for an empty hash, we can just return that in continue_params if params[:continue] isn't present, and simplify the code in the controllers to check for the values we actually want to use. 2019-06-20 13:13:02 -04:00			`return {} unless continue_params`
Check redirect path in the continue_params Fixes https://dev.gitlab.org/gitlab/gitlabhq/issues/2649 https://gitlab.com/gitlab-org/gitlab-ce/issues/13956 2016-03-07 04:06:54 -05:00
Fix denting and spec 2016-03-07 05:45:14 -05:00			`continue_params = continue_params.permit(:to, :notice, :notice_now)`
Reuses `InternalRedirect` when possible `InternalRedirect` prevents Open redirect issues by only allowing redirection to paths on the same host. It cleans up any unwanted strings from the path that could point to another host (fe. //about.gitlab.com/hello). While preserving the querystring and fragment of the uri. It is already used by: - `TermsController` - `ContinueParams` - `ImportsController` - `ForksController` - `SessionsController`: Only for verifying the host in CE. EE allows redirecting to a different instance using Geo. 2018-05-02 14:25:21 -04:00			`continue_params[:to] = safe_redirect_path(continue_params[:to])`
Check redirect path in the continue_params Fixes https://dev.gitlab.org/gitlab/gitlabhq/issues/2649 https://gitlab.com/gitlab-org/gitlab-ce/issues/13956 2016-03-07 04:06:54 -05:00
			`continue_params`
			`end`
			`end`