diff --git a/core/lib/Drupal/Component/HttpFoundation/SecuredRedirectResponse.php b/core/lib/Drupal/Component/HttpFoundation/SecuredRedirectResponse.php index 0aaf3de..77d8e8c 100644 --- a/core/lib/Drupal/Component/HttpFoundation/SecuredRedirectResponse.php +++ b/core/lib/Drupal/Component/HttpFoundation/SecuredRedirectResponse.php @@ -7,17 +7,15 @@ namespace Drupal\Component\HttpFoundation; -use Drupal\Component\Utility\UrlHelper; -use Drupal\Core\Routing\RequestContext; use \Symfony\Component\HttpFoundation\RedirectResponse; /** * Provides a common base class for safe redirects. * * In case you want to redirect to external URLs use - * \Drupal\Core\Routing\TrustedRedirectResponse. + * TrustedRedirectResponse. * - * For local URLs we use \Drupal\Core\Routing\LocalRedirectResponse which opts + * For local URLs we use LocalRedirectResponse which opts * out of external redirects. */ abstract class SecuredRedirectResponse extends RedirectResponse { @@ -26,7 +24,7 @@ * Copies an existing redirect response into a safe one. * * The safe one cannot accidentally redirect to an external URL, unless - * actively wanted (see \Drupal\Core\Routing\TrustedRedirectResponse). + * actively wanted (see TrustedRedirectResponse). * * @param \Symfony\Component\HttpFoundation\RedirectResponse $response * The original redirect. @@ -51,43 +49,12 @@ public function setTargetUrl($url) { } /** - * {@inheritdoc} - */ - protected function isSafe($url) { - return !UrlHelper::isExternal($url) || UrlHelper::externalIsLocal($url, $this->getRequestContext()->getCompleteBaseUrl()); - } - - /** - * The request context. + * Returns whether the URL is considered as safe to redirect to. * - * @var \Drupal\Core\Routing\RequestContext - */ - protected $requestContext; - - /** - * Returns the request context. + * @param string $url * - * @return \Drupal\Core\Routing\RequestContext + * @return bool */ - protected function getRequestContext() { - if (!isset($this->requestContext)) { - $this->requestContext = \Drupal::service('router.request_context'); - } - return $this->requestContext; - } - - /** - * Sets the request context. - * - * @param \Drupal\Core\Routing\RequestContext $request_context - * The request context. - * - * @return $this - */ - public function setRequestContext(RequestContext $request_context) { - $this->requestContext = $request_context; - - return $this; - } + abstract protected function isSafe($url); } diff --git a/core/lib/Drupal/Core/Routing/LocalRedirectResponse.php b/core/lib/Drupal/Core/Routing/LocalRedirectResponse.php index 56b8a62..f6d4565 100644 --- a/core/lib/Drupal/Core/Routing/LocalRedirectResponse.php +++ b/core/lib/Drupal/Core/Routing/LocalRedirectResponse.php @@ -15,4 +15,6 @@ */ class LocalRedirectResponse extends SecuredRedirectResponse { + use SecuredRedirectResponseTrait; + } diff --git a/core/lib/Drupal/Core/Routing/SecuredRedirectResponseTrait.php b/core/lib/Drupal/Core/Routing/SecuredRedirectResponseTrait.php new file mode 100644 index 0000000..8cf4d76 --- /dev/null +++ b/core/lib/Drupal/Core/Routing/SecuredRedirectResponseTrait.php @@ -0,0 +1,58 @@ +getRequestContext()->getCompleteBaseUrl()); + } + + /** + * Returns the request context. + * + * @return \Drupal\Core\Routing\RequestContext + */ + protected function getRequestContext() { + if (!isset($this->requestContext)) { + $this->requestContext = \Drupal::service('router.request_context'); + } + return $this->requestContext; + } + + /** + * Sets the request context. + * + * @param \Drupal\Core\Routing\RequestContext $request_context + * The request context. + * + * @return $this + */ + public function setRequestContext(RequestContext $request_context) { + $this->requestContext = $request_context; + + return $this; + } + +} diff --git a/core/lib/Drupal/Core/Routing/TrustedRedirectResponse.php b/core/lib/Drupal/Core/Routing/TrustedRedirectResponse.php index 5ce1c50..905369f 100644 --- a/core/lib/Drupal/Core/Routing/TrustedRedirectResponse.php +++ b/core/lib/Drupal/Core/Routing/TrustedRedirectResponse.php @@ -17,6 +17,10 @@ */ class TrustedRedirectResponse extends SecuredRedirectResponse { + use SecuredRedirectResponseTrait { + SecuredRedirectResponseTrait::isSafe as traitIsSafe; + } + /** * @todo Document. */ @@ -47,7 +51,7 @@ public function setTrustedTargetUrl($url) { * {@inheritdoc} */ protected function isSafe($url) { - return !empty($this->trustedUrls[$url]) || parent::isSafe($url); + return !empty($this->trustedUrls[$url]) || $this->traitIsSafe($url); } }