d687f6436a
Fix for open redirect vuln involving continue[to] params See merge request !2083
14 lines
392 B
Ruby
14 lines
392 B
Ruby
module ContinueParams
|
|
extend ActiveSupport::Concern
|
|
|
|
def continue_params
|
|
continue_params = params[:continue]
|
|
return nil unless continue_params
|
|
|
|
continue_params = continue_params.permit(:to, :notice, :notice_now)
|
|
return unless continue_params[:to] && continue_params[:to].start_with?('/')
|
|
return if continue_params[:to].start_with?('//')
|
|
|
|
continue_params
|
|
end
|
|
end
|