diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 57d77f54..e374fe00 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -262,7 +262,7 @@ class ApplicationController < ActionController::Base end def redirect_back_or_default(default) - back_url = CGI.unescape(params[:back_url].to_s) + back_url = URI.escape(CGI.unescape(params[:back_url].to_s)) if !back_url.blank? begin uri = URI.parse(back_url) diff --git a/test/integration/account_test.rb b/test/integration/account_test.rb index cc7565f0..39869d28 100644 --- a/test/integration/account_test.rb +++ b/test/integration/account_test.rb @@ -32,6 +32,15 @@ class AccountTest < ActionController::IntegrationTest assert_template "my/account" end + def test_redirect_after_login + target_url = "/my/account?q=%C3%A4" + + get target_url + post "/login", :username => 'jsmith', :password => 'jsmith', :back_url => @response.redirected_to[:back_url] + + assert_redirected_to target_url + end + def test_autologin user = User.find(1) Setting.autologin = "7"