From c0603b630dffe09a8f6ee87ecddcee47959c9c65 Mon Sep 17 00:00:00 2001
From: solotandem <jim@boombatower.com>
Date: Fri, 5 Apr 2013 22:32:00 +0000
Subject: [PATCH] Issue #1962854: Do not alter external URL.

---
 securepages.module |    5 +++++
 securepages.test   |   23 +++++++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/securepages.module b/securepages.module
index f3b9c63..618bed3 100644
--- a/securepages.module
+++ b/securepages.module
@@ -114,6 +114,11 @@ function securepages_form_alter(&$form, &$form_state, $form_id) {
 function securepages_drupal_goto_alter(&$path, &$options, &$http_response_code) {
   global $is_https, $user;
 
+  if (url_is_external($path)) {
+    // This site has no basis to change the path on another site.
+    return;
+  }
+
   if (!variable_get('securepages_enable', 0)) {
     return;
   }
diff --git a/securepages.test b/securepages.test
index 7a66f38..26674d8 100644
--- a/securepages.test
+++ b/securepages.test
@@ -35,6 +35,7 @@ class SecurePagesTestCase extends DrupalWebTestCase {
     $this->_testOpenRedirect();
     $this->_testXHR();
     $this->_testRoles();
+    $this->_testGoto();
   }
 
   /**
@@ -345,6 +346,28 @@ class SecurePagesTestCase extends DrupalWebTestCase {
   }
 
   /**
+   * Tests the securepages_drupal_goto_alter() function.
+   */
+  function _testGoto() {
+    global $is_https;
+    $is_https = FALSE;
+    $options = array();
+    $path = 'user';
+    securepages_drupal_goto_alter($path, $options, $http_response_code);
+    $this->assertTrue(isset($options['https']) && $options['https'], 'path user is altered.');
+    // Other paths and roles have been tested in _testMatch() and _testRoles()
+    // to return TRUE from securepages_match() and securepages_roles(), so need
+    // not be tested here.
+    $options = array();
+    $path = 'http://example.com';
+    securepages_drupal_goto_alter($path, $options, $http_response_code);
+    $this->assertTrue(empty($options), 'external path is not altered.');
+
+    // Clean up
+    $is_https = TRUE;
+  }
+
+  /**
    * Logs in a user using HTTPS.
    */
   function loginHTTPS($user) {
-- 
1.7.10.4