TEST_CODEOWNERS/rails
3
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Replace complex conditional logic with an explaining comment

Browse Source 
The logic was there to make a regression test pass https://github.com/rails/rails/blob/main/actionpack/test/controller/redirect_test.rb#L80
Originally added in https://github.com/rails/rails/pull/35054/files#diff-37c836f1b2c45e0f25de5adebb8ddaf02967632efaa5f9407b88fc163e297244R80

Since the regression was added at a time that `redirect_to` didn't have a
method level `allow_other_host` nor the class-level `raise_on_open_redirects`
we should be able to omit passing along the `allow_other_host` option.

Instead you're meant to enable `raise_on_open_redirects` in the new framework defaults.
This commit is contained in:
Kasper Timm Hansen 2021-11-05 02:40:03 +01:00
parent a2b3e3d523
commit 8bbf7d2c9a
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
actionpack/lib/action_controller/metal/redirecting.rb
View File

@ -104,10 +104,10 @@ def redirect_back(fallback_location:, allow_other_host: _allow_other_host, **arg
# options and the behavior is identical.
def redirect_back_or_to(fallback_location, allow_other_host: _allow_other_host, **options)
if request.referer && (allow_other_host || _url_host_allowed?(request.referer))
redirect_to request.referer, allow_other_host: allow_other_host, **options
redirect_to request.referer, allow_other_host: allow_other_host, **options
else
allow_other_host = true if _allow_other_host && !allow_other_host # if the fallback is an open redirect
redirect_to fallback_location, allow_other_host: allow_other_host, **options
# The method level `allow_other_host` doesn't apply in the fallback case, omit and let the `redirect_to` handling take over.
redirect_to fallback_location, **options
end
end