deepcrayon/lila
deepcrayon/lila
1
0
Fork 0
Code Releases Activity

fix goodReferrer regex didn't accept minus signs

Browse source
This commit is contained in:
Thibault Duplessis 2019-08-24 15:57:21 +02:00
parent bdab4f4564
commit 904e68f3b7
1 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
app/controllers/Auth.scala
View file

@ -31,17 +31,16 @@ object Auth extends LilaController {
}
}
private val refRegex = """[\w@/-=?]++""".r
private val refRegex = """[\w@/\-=?]++""".r
// do not allow redirects to external sites,
// nor redirect back to /mobile (which is shown after logout)
private def goodReferrer(referrer: String): Boolean = {
private def goodReferrer(referrer: String): Boolean =
referrer.nonEmpty &&
referrer.stripPrefix("/") != "mobile" && {
(!referrer.contains("//") && refRegex.matches(referrer)) ||
referrer.startsWith(Env.oAuth.baseUrl)
}
}
def authenticateUser(u: UserModel, result: Option[String => Result] = None)(implicit ctx: Context): Fu[Result] = {
if (u.ipBan) fuccess(Redirect(routes.Lobby.home))