Project

General

Profile

Download (1.83 KB)

Patch #43640 » 0004b-Validate-back-url-in-user-removal-confirmation-.patch

Florian Walchshofer, 2026-05-14 23:34

View differences:

app/controllers/groups_controller.rb
117 117 
    @users = User.not_in_group(@group).where(:id => (params[:user_id] || params[:user_ids])).to_a
118 118 
    @group.users << @users
119 119 
    respond_to do |format|
120 
      format.html {redirect_back_or_default edit_group_path(@group, :tab => 'users')}
120 
      format.html do
121 
        flash[:notice] = l(:notice_successful_update)
122 
        redirect_back_or_default edit_group_path(@group, :tab => 'users')
123 
      end
121 124 
      format.js
122 125 
      format.api do
123 126 
        if @users.any?
app/views/groups/remove_users.erb
1 1 
<%= title l(:label_confirmation) %>
2 2 

  		




  3
  3
  
    
<%= form_tag(group_users_path(@group, :user_ids => @users.map(&:id)), method: :delete) do %>

  		




  
  4
  
    
  <%= back_url_hidden_field_tag %>

  		




  4
  5
  
    
  <div class="warning">

  		




  5
  6
  
    
    <p><%= simple_format l :text_users_remove_from_group_confirmation, group: "<strong>#{@group.name}</strong>".html_safe %></p>

  		




  6
  7
  
    

  		




  ......




  15
  16
  
    

  		




  16
  17
  
    
  <p>

  		




  17
  18
  
    
    <%= submit_tag l(:button_delete) %>

  		




  18
  
  
    
    <%= link_to l(:button_cancel), @back_url || users_path %>

  		




  
  19
  
    
    <%= cancel_button_tag(users_path) %>

  		




  19
  20
  
    
  </p>

  		




  20
  21
  
    
<% end %>

  		















  (16-16/16)