Skip to content
This repository was archived by the owner on Dec 30, 2025. It is now read-only.

Login page will not redirect to urls that don't start with a / #230

Open
showell-nic wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Login page will not redirect to urls that don't start with a / #230

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6a9a821
Login page will not redirect to urls that don't start with a /
Oct 7, 2012
c14c67a
The redirect on the login page is more restrictive and redirects cann…
Oct 11, 2012
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions src/foreclojure/login.clj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
[ring.util.response :as response])
(:import [org.jasypt.util.password StrongPasswordEncryptor])
(:use [hiccup.form :only [form-to label text-field password-field check-box]]
[foreclojure.utils :only [from-mongo flash-error flash-msg form-row assuming send-email login-url]]
[foreclojure.utils :only [from-mongo flash-error flash-msg form-row assuming send-email login-url decode-url]]
[foreclojure.template :only [def-page content-page]]
[foreclojure.messages :only [err-msg]]
[compojure.core :only [defroutes GET POST]]
Expand Down Expand Up @@ -33,11 +33,12 @@

(def-page my-login-page [location]
(do
(if location (session/put! :login-to location))
(let [sanitized-location (sanitize-url location)]
(if sanitized-location (session/put! :login-to sanitized-location)))
{:title "4clojure - login"
:content
(content-page
{:main login-box})}))
{:main login-box})}))

(defn do-login [user pwd]
(let [user (.toLowerCase user)
Expand Down
19 changes: 16 additions & 3 deletions src/foreclojure/utils.clj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
[clojure.string :as string]
[foreclojure.git :as git]
[hiccup.page :as hiccup])
(:import [java.net URLEncoder]
(:import [java.net URLEncoder URLDecoder]
(org.apache.commons.lang StringEscapeUtils)
(org.apache.commons.mail HtmlEmail))
(:use [hiccup.core :only [html]]
Expand All @@ -16,7 +16,7 @@
[hiccup.form :only [label]]
[useful.fn :only [to-fix]]
[somnium.congomongo :only [fetch-one]]
[foreclojure.ring-utils :only [*url* static-url]]
[foreclojure.ring-utils :only [*url* static-url universal-url]]
[foreclojure.config :only [config repo-url]]))

(defn as-int [s]
Expand Down Expand Up @@ -84,6 +84,19 @@
([m ks f & args]
(maybe-update m ks #(apply f % args))))

(defn decode-url [url]
(URLDecoder/decode url))

(defn encode-url [url]
(URLEncoder/encode url))

(defn sanitize-url [url]
(if (nil? url)
nil
(let [decoded-url (decode-url url)]
(if (re-matches #"[a-zA-Z0-9/]+" decoded-url)
(str (encode-url (universal-url decoded-url)))))))

(defn login-url
([] (login-url *url*))
([location]
Expand Down Expand Up @@ -213,4 +226,4 @@
(defn get-theme []
(if-user [{:keys [theme]}]
(or theme default-theme)
default-theme))
default-theme))