Improve fallback behaviour for unsafe referer redirects

[rails.git] / app / controllers / friendships_controller.rb

diff --git a/app/controllers/friendships_controller.rb b/app/controllers/friendships_controller.rb
index 5cdb2a4e4323ea11645383bea4ebf94edeb2561b..93dffb4a366f6d3965aca3614147a57e54f65260 100644 (file)
--- a/app/controllers/friendships_controller.rb
+++ b/app/controllers/friendships_controller.rb
@@ -28,11 +28,9 @@ class FriendshipsController < ApplicationController
           friendship.add_error(t("friendships.make_friend.failed", :name => @new_friend.display_name))
         end
 
-        if params[:referer]
-          redirect_to safe_referer(params[:referer])
-        else
-          redirect_to user_path
-        end
+        referer = safe_referer(params[:referer]) if params[:referer]
+
+        redirect_to referer || user_path
       end
     else
       render_unknown_user params[:display_name]
@@ -51,11 +49,9 @@ class FriendshipsController < ApplicationController
           flash[:error] = t "friendships.remove_friend.not_a_friend", :name => @friend.display_name
         end
 
-        if params[:referer]
-          redirect_to safe_referer(params[:referer])
-        else
-          redirect_to user_path
-        end
+        referer = safe_referer(params[:referer]) if params[:referer]
+
+        redirect_to referer || user_path
       end
     else
       render_unknown_user params[:display_name]