Fix unvalidated redirects

2 files changed, 3 insertions, 3 deletions

diff --git a/app/controllers/track_controller.rb b/app/controllers/track_controller.rb
index 40fa69290..b2fa1cf04 100644
--- a/app/controllers/track_controller.rb
+++ b/app/controllers/track_controller.rb
@@ -215,7 +215,7 @@ class TrackController < ApplicationController
         end
         flash[:notice] += "</ul>"
 
-        redirect_to params[:r]
+        redirect_to URI.parse(params[:r]).path
     end
 
 
diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb
index c2cc426d4..bb1415baf 100644
--- a/app/controllers/user_controller.rb
+++ b/app/controllers/user_controller.rb
@@ -253,7 +253,7 @@ class UserController < ApplicationController
     def signout
         self._do_signout
         if params[:r]
-            redirect_to params[:r]
+            redirect_to URI.parse(params[:r]).path
         else
             redirect_to :controller => "general", :action => "frontpage"
         end
@@ -593,7 +593,7 @@ class UserController < ApplicationController
         end
         @user.receive_email_alerts = params[:receive_email_alerts]
         @user.save!
-        redirect_to params[:came_from]
+        redirect_to URI.parse(params[:came_from]).path
     end
 
     private