8174402471

Committed 06 Mar 2024 03:17PM UTC coverage: 65.983% (+0.05%) from 65.934%

Build # 8174402471

Build Type

push

github

Committed by

web-flow

Commit Message

fix: allow_other_host for discourse plugin redirects (#1043)

Run Details

0 of 1 new or added line in 1 file covered. (0.0%)

4085 of 6191 relevant lines covered (65.98%)

65.42 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

41.18

/plugins/discourse/app/controllers/discourse_controller.rb

class DiscourseController < ApplicationController
  before_action -> { require_plugin_enabled FoodsoftDiscourse }

  protected

  def valid_signature?
    return false if params[:sso].blank? || params[:sig].blank?

    get_hmac_hex_string(params[:sso]) == params[:sig]
  end

  def redirect_to_with_payload(url, payload)
    base64_payload = Base64.strict_encode64 payload.to_query
    sso = CGI.escape base64_payload
    sig = get_hmac_hex_string base64_payload
    redirect_to "#{url}#{url.include?('?') ? '&' : '?'}sso=#{sso}&sig=#{sig}", allow_other_host: true
  end

  def parse_payload
    payload = Rack::Utils.parse_query Base64.decode64(params[:sso])
    payload.symbolize_keys!
  end

  def get_hmac_hex_string(payload)
    discourse_sso_secret = FoodsoftConfig[:discourse_sso_secret]
    OpenSSL::HMAC.hexdigest 'sha256', discourse_sso_secret, payload
  end
end

1	class DiscourseController < ApplicationController	1✔
2	before_action -> { require_plugin_enabled FoodsoftDiscourse }	1✔
3
4	protected	1✔
5
6	def valid_signature?	1✔
7	return false if params[:sso].blank? \|\| params[:sig].blank?	×
8
9	get_hmac_hex_string(params[:sso]) == params[:sig]	×
10	end
11
12	def redirect_to_with_payload(url, payload)	1✔
13	base64_payload = Base64.strict_encode64 payload.to_query	×
14	sso = CGI.escape base64_payload	×
15	sig = get_hmac_hex_string base64_payload	×
NEW 16	redirect_to "#{url}#{url.include?('?') ? '&' : '?'}sso=#{sso}&sig=#{sig}", allow_other_host: true	×
17	end
18
19	def parse_payload	1✔
20	payload = Rack::Utils.parse_query Base64.decode64(params[:sso])	×
21	payload.symbolize_keys!	×
22	end
23
24	def get_hmac_hex_string(payload)	1✔
25	discourse_sso_secret = FoodsoftConfig[:discourse_sso_secret]	×
26	OpenSSL::HMAC.hexdigest 'sha256', discourse_sso_secret, payload	×
27	end
28	end

foodcoops / foodsoft / 8174402471

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous