Protei/PromucFlow_constructor
2
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix: check with url path when redirecting to default application url (#8207)

Browse Source 
When deciding whether to redirect to default application or the redirect url provided during signup, it'll compare with url path now. Earlier it was considering any query params added to the redirect url.
This commit is contained in:
Nayan 2021-10-25 11:43:02 +06:00 committed by GitHub
parent 6023f4e15d
commit 5fc00a6cd0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 26 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
app/server/appsmith-server/src/main/java/com/appsmith/server/authentication/handlers/AuthenticationSuccessHandler.java
View File

@ -24,6 +24,7 @@ import org.springframework.security.web.server.ServerRedirectStrategy;
import org.springframework.security.web.server.WebFilterExchange; import org.springframework.security.web.server.WebFilterExchange;
import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler; import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler;
import org.springframework.stereotype.Component; import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;
import org.springframework.web.server.ServerWebExchange; import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono; import reactor.core.publisher.Mono;
import reactor.core.scheduler.Schedulers; import reactor.core.scheduler.Schedulers;
@ -194,7 +195,7 @@ public class AuthenticationSuccessHandler implements ServerAuthenticationSuccess
boolean addFirstTimeExperienceParam = false; boolean addFirstTimeExperienceParam = false;
if (isFromSignup) { if (isFromSignup) {
if(redirectUrl.endsWith(RedirectHelper.DEFAULT_REDIRECT_URL) && defaultApplication != null) { if(isDefaultRedirectUrl(redirectUrl) && defaultApplication != null) {
addFirstTimeExperienceParam = true; addFirstTimeExperienceParam = true;
HttpHeaders headers = exchange.getRequest().getHeaders(); HttpHeaders headers = exchange.getRequest().getHeaders();
redirectUrl = redirectHelper.buildApplicationUrl(defaultApplication, headers); redirectUrl = redirectHelper.buildApplicationUrl(defaultApplication, headers);
@ -205,6 +206,22 @@ public class AuthenticationSuccessHandler implements ServerAuthenticationSuccess
return redirectStrategy.sendRedirect(exchange, URI.create(redirectUrl)); return redirectStrategy.sendRedirect(exchange, URI.create(redirectUrl));
} }
/**
* Checks if the provided url is default redirect url
* @param url which needs to be checked
* @return true if default url. false otherwise
*/
private boolean isDefaultRedirectUrl(String url) {
if(StringUtils.isEmpty(url)) {
return true;
}
try {
return URI.create(url).getPath().endsWith(RedirectHelper.DEFAULT_REDIRECT_URL);
} catch (IllegalArgumentException e) {
return false;
}
}
private Mono<Void> handleRedirect(WebFilterExchange webFilterExchange, Application defaultApplication, boolean isFromSignup) { private Mono<Void> handleRedirect(WebFilterExchange webFilterExchange, Application defaultApplication, boolean isFromSignup) {
ServerWebExchange exchange = webFilterExchange.getExchange(); ServerWebExchange exchange = webFilterExchange.getExchange();
@ -214,13 +231,15 @@ public class AuthenticationSuccessHandler implements ServerAuthenticationSuccess
.flatMap(redirectHelper::getRedirectUrl) .flatMap(redirectHelper::getRedirectUrl)
.map(s -> { .map(s -> {
String url = s; String url = s;
boolean addFirstTimeExperienceParam = false;
if(s.endsWith(RedirectHelper.DEFAULT_REDIRECT_URL) && defaultApplication != null) {
addFirstTimeExperienceParam = true;
HttpHeaders headers = exchange.getRequest().getHeaders();
url = redirectHelper.buildApplicationUrl(defaultApplication, headers);
}
if (isFromSignup) { if (isFromSignup) {
boolean addFirstTimeExperienceParam = false;
// only redirect to default application if the redirectUrl contains no other url
if(isDefaultRedirectUrl(url) && defaultApplication != null) {
addFirstTimeExperienceParam = true;
HttpHeaders headers = exchange.getRequest().getHeaders();
url = redirectHelper.buildApplicationUrl(defaultApplication, headers);
}
// This redirectUrl will be used by the client to redirect after showing a welcome page. // This redirectUrl will be used by the client to redirect after showing a welcome page.
url = buildSignupSuccessUrl(url, addFirstTimeExperienceParam); url = buildSignupSuccessUrl(url, addFirstTimeExperienceParam);
} }