Resolve unsafe redirect on admin sign in

katalyst · Nov 21, 2024 · c219d1f · c219d1f
1 parent c2d34a7
commit c219d1f
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    katalyst-koi (4.14.0)
+    katalyst-koi (4.14.1)
       bcrypt
       importmap-rails
       katalyst-content

diff --git a/app/controllers/admin/sessions_controller.rb b/app/controllers/admin/sessions_controller.rb
@@ -19,7 +19,7 @@ def create
 
         session[:admin_user_id] = admin_user.id
 
-        redirect_to(params[:redirect].presence || admin_dashboard_path, status: :see_other)
+        redirect_to(url_from(params[:redirect].presence) || admin_dashboard_path, status: :see_other)
       else
         admin_user = Admin::User.new(session_params.slice(:email, :password))
         admin_user.errors.add(:email, "Invalid email or password")

diff --git a/katalyst-koi.gemspec b/katalyst-koi.gemspec
@@ -3,7 +3,7 @@
 # Describe your gem and declare its dependencies:
 Gem::Specification.new do |s|
   s.name        = "katalyst-koi"
-  s.version     = "4.14.0"
+  s.version     = "4.14.1"
   s.authors     = ["Katalyst Interactive"]
   s.email       = ["[email protected]"]