From 6f2e1bd23ab7670e3bbc76d569b80007ca38af05 Mon Sep 17 00:00:00 2001
From: mrsdizzie <info@mrsdizzie.com>
Date: Wed, 20 Mar 2019 22:06:16 -0400
Subject: [PATCH] Don't Unescape redirect_to cookie value (#6399)
redirect_to holds a value that we want to redirect back to after login.
This value can be a path with intentonally escaped values and we
should not unescape it.
Fixes #4475
---
routers/user/auth.go | 9 ++++-----
routers/user/auth_openid.go | 2 +-
2 files changed, 5 insertions(+), 6 deletions(-)
diff --git a/routers/user/auth.go b/routers/user/auth.go
index fc4c358a9a..0a24702c17 100644
--- a/routers/user/auth.go
+++ b/routers/user/auth.go
@@ -9,7 +9,6 @@ import (
"errors"
"fmt"
"net/http"
- "net/url"
"strings"
"code.gitea.io/gitea/models"
@@ -96,7 +95,7 @@ func checkAutoLogin(ctx *context.Context) bool {
if len(redirectTo) > 0 {
ctx.SetCookie("redirect_to", redirectTo, 0, setting.AppSubURL, "", setting.SessionConfig.Secure, true)
} else {
- redirectTo, _ = url.QueryUnescape(ctx.GetCookie("redirect_to"))
+ redirectTo = ctx.GetCookie("redirect_to")
}
if isSucceed {
@@ -496,7 +495,7 @@ func handleSignInFull(ctx *context.Context, u *models.User, remember bool, obeyR
return setting.AppSubURL + "/"
}
- if redirectTo, _ := url.QueryUnescape(ctx.GetCookie("redirect_to")); len(redirectTo) > 0 && !util.IsExternalURL(redirectTo) {
+ if redirectTo := ctx.GetCookie("redirect_to"); len(redirectTo) > 0 && !util.IsExternalURL(redirectTo) {
ctx.SetCookie("redirect_to", "", -1, setting.AppSubURL, "", setting.SessionConfig.Secure, true)
if obeyRedirect {
ctx.RedirectToFirst(redirectTo)
@@ -587,7 +586,7 @@ func handleOAuth2SignIn(u *models.User, gothUser goth.User, ctx *context.Context
return
}
- if redirectTo, _ := url.QueryUnescape(ctx.GetCookie("redirect_to")); len(redirectTo) > 0 {
+ if redirectTo := ctx.GetCookie("redirect_to"); len(redirectTo) > 0 {
ctx.SetCookie("redirect_to", "", -1, setting.AppSubURL, "", setting.SessionConfig.Secure, true)
ctx.RedirectToFirst(redirectTo)
return
@@ -1298,7 +1297,7 @@ func MustChangePasswordPost(ctx *context.Context, cpt *captcha.Captcha, form aut
log.Trace("User updated password: %s", u.Name)
- if redirectTo, _ := url.QueryUnescape(ctx.GetCookie("redirect_to")); len(redirectTo) > 0 && !util.IsExternalURL(redirectTo) {
+ if redirectTo := ctx.GetCookie("redirect_to"); len(redirectTo) > 0 && !util.IsExternalURL(redirectTo) {
ctx.SetCookie("redirect_to", "", -1, setting.AppSubURL)
ctx.RedirectToFirst(redirectTo)
return
diff --git a/routers/user/auth_openid.go b/routers/user/auth_openid.go
index b0e9092c78..8a8a5b7306 100644
--- a/routers/user/auth_openid.go
+++ b/routers/user/auth_openid.go
@@ -47,7 +47,7 @@ func SignInOpenID(ctx *context.Context) {
if len(redirectTo) > 0 {
ctx.SetCookie("redirect_to", redirectTo, 0, setting.AppSubURL, "", setting.SessionConfig.Secure, true)
} else {
- redirectTo, _ = url.QueryUnescape(ctx.GetCookie("redirect_to"))
+ redirectTo = ctx.GetCookie("redirect_to")
}
if isSucceed {