diff --git a/app/models/site_setting.rb b/app/models/site_setting.rb index 56c1cb5f95c..67c2aa7a639 100644 --- a/app/models/site_setting.rb +++ b/app/models/site_setting.rb @@ -71,13 +71,15 @@ class SiteSetting < ActiveRecord::Base def self.allows_embeddable_host?(host) return false if embeddable_hosts.blank? uri = URI(host) rescue nil - return false unless uri.present? host = uri.host return false unless host.present? !!embeddable_hosts.split("\n").detect {|h| h.sub(/^https?\:\/\//, '') == host } + + hosts = embeddable_hosts.split("\n").map {|h| (URI(h).host rescue nil) || h } + !!hosts.detect {|h| h == host} end def self.anonymous_homepage diff --git a/spec/controllers/embed_controller_spec.rb b/spec/controllers/embed_controller_spec.rb index 4fc2319d62f..ee91d6cb245 100644 --- a/spec/controllers/embed_controller_spec.rb +++ b/spec/controllers/embed_controller_spec.rb @@ -68,7 +68,7 @@ describe EmbedController do context "with multiple hosts" do before do - SiteSetting.embeddable_hosts = "#{host}\nhttp://discourse.org" + SiteSetting.embeddable_hosts = "#{host}\nhttp://discourse.org\nhttps://example.com/1234" end context "success" do @@ -84,6 +84,12 @@ describe EmbedController do expect(response).to be_success end + it "works with a host with a path" do + controller.request.stubs(:referer).returns("https://example.com/some-other-path") + get :comments, embed_url: embed_url + expect(response).to be_success + end + it "doesn't work with a made up host" do controller.request.stubs(:referer).returns("http://codinghorror.com/invalid-url") get :comments, embed_url: embed_url