Escape back_url field value (#2320).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2125 e93f8b46-1217-0410-a6f0-8f06a7374b81

Escape back_url field value (#2320).
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2125 e93f8b46-1217-0410-a6f0-8f06a7374b81
29f364f6 · Jean-Philippe Lang · b21b6c36 · 29f364f6
Commit 29f364f6 authored Dec 12, 2008 by Jean-Philippe Lang
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

application_helper.rb app/helpers/application_helper.rb +2 -1

No files found.
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -18,6 +18,7 @@
 require 'coderay'
 require 'coderay/helpers/file_type'
 require 'forwardable'
+require 'cgi'

 module ApplicationHelper
  include Redmine::WikiFormatting::Macros::Definitions
@@ -525,7 +526,7 @@ module ApplicationHelper

  def back_url_hidden_field_tag
    back_url = params[:back_url] || request.env['HTTP_REFERER']
-    hidden_field_tag('back_url', back_url) unless back_url.blank?
+    hidden_field_tag('back_url', CGI.escape(back_url)) unless back_url.blank?
  end

  def check_all_links(form_name)