FEATURE: setting to allow arbitrary redirects from sso origin

if sso_allows_all_return_paths is set to true you can redirect off-site from sso success
This commit is contained in:
Sam 2016-12-16 13:37:44 +11:00
parent 6ff309aa80
commit 61eb134181
4 changed files with 16 additions and 1 deletions

View File

@ -118,7 +118,7 @@ class SessionController < ApplicationController
if return_path !~ /^\/[^\/]/
begin
uri = URI(return_path)
return_path = path("/") unless uri.host == Discourse.current_hostname
return_path = path("/") unless SiteSetting.sso_allows_all_return_paths || uri.host == Discourse.current_hostname
rescue
return_path = path("/")
end

View File

@ -1020,6 +1020,7 @@ en:
sso_overrides_name: "Overrides local full name with external site full name from SSO payload on every login, and prevent local changes."
sso_overrides_avatar: "Overrides user avatar with external site avatar from SSO payload. If enabled, disabling allow_uploaded_avatars is highly recommended"
sso_not_approved_url: "Redirect unapproved SSO accounts to this URL"
sso_allows_all_return_paths: "Do not restrict the domain for return_paths provided by SSO (by default return path must be on current site)"
enable_local_logins: "Enable local username and password login based accounts. (Note: this must be enabled for invites to work)"
allow_new_registrations: "Allow new user registrations. Uncheck this to prevent anyone from creating a new account."

View File

@ -298,6 +298,7 @@ login:
enable_sso:
client: true
default: false
sso_allows_all_return_paths: false
enable_sso_provider: false
verbose_sso_logging: false
sso_url:

View File

@ -141,6 +141,19 @@ describe SessionController do
expect(response).to redirect_to('/b/')
end
it 'redirects to random url if it is allowed' do
SiteSetting.sso_allows_all_return_paths = true
sso = get_sso('https://gusundtrout.com')
sso.external_id = '666' # the number of the beast
sso.email = 'bob@bob.com'
sso.name = 'Sam Saffron'
sso.username = 'sam'
get :sso_login, Rack::Utils.parse_query(sso.payload)
expect(response).to redirect_to('https://gusundtrout.com')
end
it 'redirects to root if the host of the return_path is different' do
sso = get_sso('//eviltrout.com')
sso.external_id = '666' # the number of the beast