Redmine

The Doorkeeper configuration in config/initializers/30-redmine.rb, added in r23837 (#24808), is intended to allow non-HTTPS redirect URIs only for loopback hosts, as stated in its comment. However, the list of exempted hosts contains two values that do not match this intent:

# allow http loopback redirect URIs but require https for all others
force_ssl_in_redirect_uri { |uri| !%w[localhost 127.0.0.1 web localohst:8080].include?(uri.host) }

• web is not a loopback host, but redirect URIs on it are allowed without HTTPS.
• localohst:8080 is a typo for localhost and never matches.

The attached patch removes both values.

The patch also adds the IPv6 loopback address ::1, which is a loopback host but is missing from the list. Because URI#host returns this address in brackets ([::1]), the patch compares against URI#hostname instead.