3 Commits

Author	SHA1	Message	Date
Jesse Dijkstra	f546a5ce1d	Remove open redirect by removing double slashes from redirects (#7247) ... no issue Double slashes are treated as a HTTP calls as specified in [RFC1801](http://www.ietf.org/rfc/rfc1808.txt). Because of this behaviour the uncapitalise created an open redirect. By removing double slashes in the path we ensure open redirects cannot be created. As an example, please click the following URL: https://dev.ghost.org///Google.com/. This issue has been reported by pentesters of our product [LearningSpaces.io](http://learningspaces.io).	2016-08-23 13:47:59 +02:00
Hannah Wolfe	8895f41ee2	Uncapitalise respects subdirectories & no encoding ... no issue - Uncapitalise was dropping the subdirectory when redirecting - so the base url has been added where present - Uncapitalise was also working differently in node 0.10 and 0.12 - so the path is decoded before testing for uppercase - Adds some test coverage	2015-09-24 18:52:30 +01:00
Alex Kleissner	05e49d9a96	Move uncapitalize into its own file. ... refs #5286 - Moved the logic into its own file - Added unit tests	2015-06-10 12:21:15 -07:00