FEATURE: setting to allow arbitrary redirects from sso origin
if sso_allows_all_return_paths is set to true you can redirect off-site from sso success
This commit is contained in:
parent
6ff309aa80
commit
61eb134181
|
@ -118,7 +118,7 @@ class SessionController < ApplicationController
|
|||
if return_path !~ /^\/[^\/]/
|
||||
begin
|
||||
uri = URI(return_path)
|
||||
return_path = path("/") unless uri.host == Discourse.current_hostname
|
||||
return_path = path("/") unless SiteSetting.sso_allows_all_return_paths || uri.host == Discourse.current_hostname
|
||||
rescue
|
||||
return_path = path("/")
|
||||
end
|
||||
|
|
|
@ -1020,6 +1020,7 @@ en:
|
|||
sso_overrides_name: "Overrides local full name with external site full name from SSO payload on every login, and prevent local changes."
|
||||
sso_overrides_avatar: "Overrides user avatar with external site avatar from SSO payload. If enabled, disabling allow_uploaded_avatars is highly recommended"
|
||||
sso_not_approved_url: "Redirect unapproved SSO accounts to this URL"
|
||||
sso_allows_all_return_paths: "Do not restrict the domain for return_paths provided by SSO (by default return path must be on current site)"
|
||||
|
||||
enable_local_logins: "Enable local username and password login based accounts. (Note: this must be enabled for invites to work)"
|
||||
allow_new_registrations: "Allow new user registrations. Uncheck this to prevent anyone from creating a new account."
|
||||
|
|
|
@ -298,6 +298,7 @@ login:
|
|||
enable_sso:
|
||||
client: true
|
||||
default: false
|
||||
sso_allows_all_return_paths: false
|
||||
enable_sso_provider: false
|
||||
verbose_sso_logging: false
|
||||
sso_url:
|
||||
|
|
|
@ -141,6 +141,19 @@ describe SessionController do
|
|||
expect(response).to redirect_to('/b/')
|
||||
end
|
||||
|
||||
it 'redirects to random url if it is allowed' do
|
||||
SiteSetting.sso_allows_all_return_paths = true
|
||||
|
||||
sso = get_sso('https://gusundtrout.com')
|
||||
sso.external_id = '666' # the number of the beast
|
||||
sso.email = 'bob@bob.com'
|
||||
sso.name = 'Sam Saffron'
|
||||
sso.username = 'sam'
|
||||
|
||||
get :sso_login, Rack::Utils.parse_query(sso.payload)
|
||||
expect(response).to redirect_to('https://gusundtrout.com')
|
||||
end
|
||||
|
||||
it 'redirects to root if the host of the return_path is different' do
|
||||
sso = get_sso('//eviltrout.com')
|
||||
sso.external_id = '666' # the number of the beast
|
||||
|
|
Loading…
Reference in New Issue