BigBlueButton/bigbluebutton-Github
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Revert "compare the true URLs, ignore protocols"

Browse Source 
This reverts commit 3bb6b70d90.
This commit is contained in:
Anton Georgiev 2020-10-09 16:54:34 -04:00
parent 3bb6b70d90
commit 1ffad034f7
1 changed files with 3 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
bigbluebutton-html5/imports/ui/components/meeting-ended/service.js
View File

@ -1,26 +1,12 @@
import { Meteor } from 'meteor/meteor';
import Auth from '/imports/ui/services/auth';
import logger from '/imports/startup/client/logger';
export default function allowRedirectToLogoutURL() {
const ALLOW_DEFAULT_LOGOUT_URL = Meteor.settings.public.app.allowDefaultLogoutUrl;
if (Auth.logoutURL) {
// default logoutURL case
// compare only the host to ignore protocols, www, trailing '/', etc
try {
// new URL object with invalid url throws an error and could crash the application
const urlWithoutProtocolForAuthLogout = new URL(Auth.logoutURL).host;
const urlWithoutProtocolForLocationOrigin = new URL(window.location.origin).host;
if (urlWithoutProtocolForAuthLogout === urlWithoutProtocolForLocationOrigin) {
return ALLOW_DEFAULT_LOGOUT_URL;
}
} catch (error) {
// there was an issue checking if the passed logoutURL was a valid URL.
// Do not use it for a redirect
logger.error({ logCode: 'meeting_ended_logouturl_redirect_error', extraInfo: { error, logoutURL: Auth.logoutURL } },
'There was an issue checking if the passed logoutURL was a valid URL');
return false;
}
// default logoutURL
if (Auth.logoutURL === window.location.origin) return ALLOW_DEFAULT_LOGOUT_URL;
// custom logoutURL
return true;