prevent redirect to non yag urls, and change error message for soundboard

Author: ashishjh-bst

soundboard/web.go

@@ -166,7 +166,8 @@ func HandleNew(w http.ResponseWriter, r *http.Request) (web.TemplateData, error)
 		var resp *http.Response
 		resp, err = http.Get(r.FormValue("SoundURL"))
 		if err != nil {
-			tmpl.AddAlerts(web.ErrorAlert("Failed downloading sound: " + err.Error()))
+			logger.WithError(err).Error("Failed downloading soundboard sound")
+			tmpl.AddAlerts(web.ErrorAlert("Failed downloading sound from: " + r.FormValue("SoundURL") + " Make sure the link is correct"))
 			destFile.Close()
 		} else {
 			defer resp.Body.Close()

web/handlers_auth.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
+	"net/url"
 	"strings"
 	"time"
 
@@ -47,13 +48,11 @@ func HandleLogin(w http.ResponseWriter, r *http.Request) {
 	}
 
 	redir := r.FormValue("goto")
-	if redir != "" && strings.HasPrefix(redir, "/") {
+	if redir != "" && strings.HasPrefix(redir, "/") && !strings.HasPrefix(redir, "//") && !strings.HasPrefix(redir, "/\\") {
 		common.RedisPool.Do(radix.Cmd(nil, "SET", "csrf_redir:"+csrfToken, redir, "EX", "500"))
 	}
 
 	url := OauthConf.AuthCodeURL(csrfToken, oauth2.AccessTypeOnline)
-	// disabled prompt to see if the multiple requests are still happening when user expliclity consents to login
-	// url += "&prompt=none"
 	http.Redirect(w, r, url, http.StatusTemporaryRedirect)
 }
 
@@ -89,15 +88,20 @@ func HandleConfirmLogin(w http.ResponseWriter, r *http.Request) {
 
 	http.SetCookie(w, sessionCookie)
 
-	var redirUrl string
-	err = common.RedisPool.Do(radix.Cmd(&redirUrl, "GET", "csrf_redir:"+state))
+	var redir string
+	err = common.RedisPool.Do(radix.Cmd(&redir, "GET", "csrf_redir:"+state))
 	if err != nil {
-		redirUrl = "/manage"
+		redir = "/manage"
 	} else {
 		common.RedisPool.Do(radix.Cmd(nil, "DEL", "csrf_redir:"+state))
 	}
 
-	http.Redirect(w, r, redirUrl, http.StatusTemporaryRedirect)
+	redirParsed, err := url.Parse(redir)
+	if err != nil || redirParsed.Host != "" || redirParsed.Scheme != "" {
+		redirParsed, _ = url.Parse("/manage")
+	}
+
+	http.Redirect(w, r, redirParsed.String(), http.StatusTemporaryRedirect)
 
 }