diff options
| author | Sean McGivern <sean@gitlab.com> | 2017-04-06 00:17:49 +0300 |
|---|---|---|
| committer | DJ Mountney <david@twkie.net> | 2017-04-06 01:58:52 +0300 |
| commit | c22e9d8b818d7fec96710a7deb47a84cbbbf41f0 (patch) | |
| tree | 4bb3052d856be6ea032e85f488955995ec0311aa /app | |
| parent | 5f81898343cabd65a49dbbba9d7c00e06b0eca69 (diff) | |
Merge branch 'open-redirect-fix-continue-to' into 'security'
Fix for open redirect vuln involving continue[to] params
See merge request !2083
Diffstat (limited to 'app')
| -rw-r--r-- | app/controllers/concerns/continue_params.rb | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/app/controllers/concerns/continue_params.rb b/app/controllers/concerns/continue_params.rb index 0a995c45bdf..eb3a623acdd 100644 --- a/app/controllers/concerns/continue_params.rb +++ b/app/controllers/concerns/continue_params.rb @@ -7,6 +7,7 @@ module ContinueParams continue_params = continue_params.permit(:to, :notice, :notice_now) return unless continue_params[:to] && continue_params[:to].start_with?('/') + return if continue_params[:to].start_with?('//') continue_params end |