Fix unvalidated redirects

2 files changed, 3 insertions, 3 deletions

diff --git a/app/controllers/track_controller.rb b/app/controllers/track_controller.rb
index 15da7f327..cd26af0bc 100644
--- a/app/controllers/track_controller.rb
+++ b/app/controllers/track_controller.rb
@@ -215,7 +215,7 @@ class TrackController < ApplicationController
         end
         flash[:notice] += "</ul>"
 
-        redirect_to params[:r]
+        redirect_to URI.parse(params[:r]).path
     end
 
 
diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb
index 30f8700a5..554747002 100644
--- a/app/controllers/user_controller.rb
+++ b/app/controllers/user_controller.rb
@@ -249,7 +249,7 @@ class UserController < ApplicationController
     def signout
         self._do_signout
         if params[:r]
-            redirect_to params[:r]
+            redirect_to URI.parse(params[:r]).path
         else
             redirect_to :controller => "general", :action => "frontpage"
         end
@@ -588,7 +588,7 @@ class UserController < ApplicationController
         end
         @user.receive_email_alerts = params[:receive_email_alerts]
         @user.save!
-        redirect_to params[:came_from]
+        redirect_to URI.parse(params[:came_from]).path
     end
 
     private