app/controllers/ahoy/messages_controller.rb in ahoy_email-2.1.1 vs app/controllers/ahoy/messages_controller.rb in ahoy_email-2.1.2

- old
+ new

@@ -23,21 +23,24 @@ url = params[:u].to_s signature = params[:s].to_s expected_signature = AhoyEmail::Utils.signature(token: token, campaign: campaign, url: url) end + redirect_options = {} + redirect_options[:allow_other_host] = true if ActionPack::VERSION::MAJOR >= 7 + if ActiveSupport::SecurityUtils.secure_compare(signature, expected_signature) data = {} data[:campaign] = campaign if campaign data[:token] = token data[:url] = url data[:controller] = self AhoyEmail::Utils.publish(:click, data) - redirect_to url + redirect_to url, **redirect_options else if AhoyEmail.invalid_redirect_url - redirect_to AhoyEmail.invalid_redirect_url + redirect_to AhoyEmail.invalid_redirect_url, **redirect_options else render plain: "Link expired", status: :not_found end end end