Merge pull request #542 from songjiayang/cache_referrer

Skip referrer cache if it's from other site

app/controllers/sessions_controller.rb

@@ -4,7 +4,7 @@ class SessionsController < Devise::SessionsController
 
   def new
     super
-    session['user_return_to'] = request.referrer
+    cache_referrer
   end
 
   def create
@@ -25,4 +25,11 @@ def valify_captcha!
     end
     true
   end
+
+  private
+    def cache_referrer
+      if request.referrer && request.referrer.include?(request.domain)
+        session['user_return_to'] = request.referrer
+      end
+    end
 end

spec/controllers/sessions_controller_spec.rb

@@ -0,0 +1,25 @@
+require 'rails_helper'
+
+describe SessionsController, type: :controller do
+  describe ':new' do
+    before { request.env["devise.mapping"] = Devise.mappings[:user] }
+    it 'should render new tempalte' do
+      get :new
+      expect(response).to render_template(:new)
+    end
+
+    it "should store referrer if it's from self site" do
+      referrer = "#{request.base_url}/account/edit"
+      request.env["HTTP_REFERER"] = referrer
+      get :new
+      session['user_return_to'].should be referrer
+    end
+
+    it "should skip referrer if it's from other site" do
+      referrer = "http://#{SecureRandom.hex(4)}.com"
+      request.env["HTTP_REFERER"] = referrer
+      get :new
+      session['user_return_to'].should be_nil
+    end
+  end
+end