Fix some XSS issues

[rails.git] / app / controllers / user_controller.rb

diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb
index a066c1c63b3c6f812264c56b4106a0f6f20e1472..9c5ac0d09edf8bf400c196cb14b3ec3d54096082 100644 (file)
--- a/app/controllers/user_controller.rb
+++ b/app/controllers/user_controller.rb
@@ -17,7 +17,7 @@ class UserController < ApplicationController
 
   filter_parameter_logging :password, :pass_crypt, :pass_crypt_confirmation
 
-  cache_sweeper :user_sweeper, :only => [:account, :set_status, :delete], :unless => STATUS == :database_offline
+  cache_sweeper :user_sweeper, :only => [:account, :set_status, :delete]
 
   def terms
     @legale = params[:legale] || OSM.IPToCountry(request.remote_ip) || DEFAULT_LEGALE
@@ -67,7 +67,7 @@ class UserController < ApplicationController
         elsif @user.terms_agreed?
           # Already agreed to terms, so just show settings
           redirect_to :action => :account, :display_name => @user.display_name
-        elsif params[:user] and params[:user][:openid_url]
+        elsif params[:user] and params[:user][:openid_url] and not params[:user][:openid_url].empty?
           # Verify OpenID before moving on
           session[:new_user] = @user
           openid_verify(params[:user][:openid_url], @user)
@@ -125,8 +125,10 @@ class UserController < ApplicationController
       @user.languages = request.user_preferred_languages
       @user.terms_agreed = Time.now.getutc
       @user.terms_seen = true
+      @user.openid_url = nil if @user.openid_url and @user.openid_url.empty?
       
       if @user.save
+        flash[:piwik_goal] = PIWIK_SIGNUP_GOAL if defined?(PIWIK_SIGNUP_GOAL)
         flash[:notice] = t 'user.new.flash create success message', :email => @user.email
         Notifier.deliver_signup_confirm(@user, @user.tokens.create(:referer => session.delete(:referer)))
         session[:token] = @user.tokens.create.token
@@ -286,9 +288,9 @@ class UserController < ApplicationController
         if token
           token.destroy
         end
-        session[:token] = nil
+        session.delete(:token)
       end
-      session[:user] = nil
+      session.delete(:user)
       session_expires_automatically
       if params[:referer]
         redirect_to params[:referer]
@@ -538,6 +540,10 @@ private
               failed_login t('user.login.auth failure')
           end
         else
+          # Guard against not getting any extension data
+          sreg = Hash.new if sreg.nil?
+          ax = Hash.new if ax.nil?
+
           # We don't have a user registered to this OpenID, so redirect
           # to the create account page with username and email filled
           # in if they have been given by the OpenID provider through
@@ -604,7 +610,7 @@ private
     session[:user] = user.id
     session_expires_after 1.month if session[:remember_me]
 
-    target = params[:referer] || url_for(:controller => :site, :action => :index)
+    target = session[:referer] || url_for(:controller => :site, :action => :index)
 
     # The user is logged in, so decide where to send them:
     #