39916fdfed
`InternalRedirect` prevents Open redirect issues by only allowing redirection to paths on the same host. It cleans up any unwanted strings from the path that could point to another host (fe. //about.gitlab.com/hello). While preserving the querystring and fragment of the uri. It is already used by: - `TermsController` - `ContinueParams` - `ImportsController` - `ForksController` - `SessionsController`: Only for verifying the host in CE. EE allows redirecting to a different instance using Geo.
14 lines
354 B
Ruby
14 lines
354 B
Ruby
module ContinueParams
|
|
include InternalRedirect
|
|
extend ActiveSupport::Concern
|
|
|
|
def continue_params
|
|
continue_params = params[:continue]
|
|
return nil unless continue_params
|
|
|
|
continue_params = continue_params.permit(:to, :notice, :notice_now)
|
|
continue_params[:to] = safe_redirect_path(continue_params[:to])
|
|
|
|
continue_params
|
|
end
|
|
end
|