Strip invalid characters from referer URLs

This commit is contained in:
Omar Roth 2020-03-15 17:37:51 -04:00
parent 70cbe91776
commit 4011a113cc
No known key found for this signature in database
GPG key ID: B8254FB7EC3D37F2

View file

@ -316,7 +316,7 @@ def get_referer(env, fallback = "/", unroll = true)
end
referer = referer.full_path
referer = "/" + referer.lstrip("/\\")
referer = "/" + referer.gsub(/[^\/?@&%=\-_.0-9a-zA-Z]/, "").lstrip("/\\")
if referer == env.request.path
referer = fallback