X-Git-Url: https://git.openstreetmap.org/rails.git/blobdiff_plain/9f993fe8c8be4664f975df426d69ded1dca77ae3..d4130bcac83015564f0326457f2bb67d1b5ebab6:/app/controllers/application_controller.rb

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index a2211ea69..616223a06 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -65,7 +65,7 @@ class ApplicationController < ActionController::Base
     if request.cookies["_osm_session"].to_s == ""
       if params[:cookie_test].nil?
         session[:cookie_test] = true
-        redirect_to params.to_unsafe_h.merge(:cookie_test => "true")
+        redirect_to params.to_unsafe_h.merge(:only_path => true, :cookie_test => "true")
         false
       else
         flash.now[:warning] = t "application.require_cookies.cookies_needed"
@@ -372,4 +372,19 @@ class ApplicationController < ActionController::Base
 
   # override to stop oauth plugin sending errors
   def invalid_oauth_response; end
+
+  # clean any referer parameter
+  def safe_referer(referer)
+    referer = URI.parse(referer)
+
+    if referer.scheme == "http" || referer.scheme == "https"
+      referer.scheme = nil
+      referer.host = nil
+      referer.port = nil
+    elsif referer.scheme || referer.host || referer.port
+      referer = nil
+    end
+
+    referer.to_s
+  end
 end