diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index ad16b0e77..29c14f612 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -502,21 +502,20 @@ class ApplicationController < ActionController::Base end begin - uri = URI.parse(back_url) - rescue URI::InvalidURIError + uri = Addressable::URI.parse(back_url) + [:scheme, :host, :port].each do |component| + if uri.send(component).present? && uri.send(component) != request.send(component) + return false + end + + uri.send(:"#{component}=", nil) + end + # Always ignore basic user:password in the URL + uri.userinfo = nil + rescue Addressable::URI::InvalidURIError return false end - [:scheme, :host, :port].each do |component| - if uri.send(component).present? && uri.send(component) != request.send(component) - return false - end - - uri.send(:"#{component}=", nil) - end - # Always ignore basic user:password in the URL - uri.userinfo = nil - path = uri.to_s # Ensure that the remaining URL starts with a slash, followed by a # non-slash character or the end