You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: actionpack/lib/action_controller/metal/redirecting.rb
+4-4Lines changed: 4 additions & 4 deletions
Original file line number
Diff line number
Diff line change
@@ -66,13 +66,13 @@ class UnsafeRedirectError < StandardError; end
66
66
# === Open Redirect protection
67
67
#
68
68
# By default, Rails protects against redirecting to external hosts for your app's safety, so called open redirects.
69
-
# Note: this was a new default in Rails 7.0, after upgrading opt-in by uncommenting the line with #raise_on_open_redirects in <tt>config/initializers/new_framework_defaults_7_0.rb</tt>
69
+
# Note: this was a new default in Rails 7.0, after upgrading opt-in by uncommenting the line with +raise_on_open_redirects+ in <tt>config/initializers/new_framework_defaults_7_0.rb</tt>
70
70
#
71
71
# Here #redirect_to automatically validates the potentially-unsafe URL:
72
72
#
73
73
# redirect_to params[:redirect_url]
74
74
#
75
-
# Raises #UnsafeRedirectError in the case of an unsafe redirect.
75
+
# Raises UnsafeRedirectError in the case of an unsafe redirect.
76
76
#
77
77
# To allow any external redirects pass `allow_other_host: true`, though using a user-provided param in that case is unsafe.
# NOTE: there's a similarity with #url_for, which generates an internal URL from various options from within the app, e.g. <tt>url_for(@post)</tt>.
167
+
# NOTE: there's a similarity with ActionDispatch::Routing::UrlFor#url_for, which generates an internal URL from various options from within the app, e.g. <tt>url_for(@post)</tt>.
168
168
# However, #url_from is meant to take an external parameter to verify as in <tt>url_from(params[:redirect_url])</tt>.
0 commit comments