diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 9bd6b831a..ac0fe19f6 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -507,20 +507,19 @@ class ApplicationController < ActionController::Base end begin - uri = URI.parse(back_url) - rescue URI::InvalidURIError - return false - end + uri = Addressable::URI.parse(back_url) + [:scheme, :host, :port].each do |component| + if uri.send(component).present? && uri.send(component) != request.send(component) + return false + end - [:scheme, :host, :port].each do |component| - if uri.send(component).present? && uri.send(component) != request.send(component) - return false + uri.send(:"#{component}=", nil) end - - uri.send(:"#{component}=", nil) + # Always ignore basic user:password in the URL + uri.userinfo = nil + rescue Addressable::URI::InvalidURIError + return false end - # Always ignore basic user:password in the URL - uri.userinfo = nil path = uri.to_s # Ensure that the remaining URL starts with a slash, followed by a