Fix unvalidated redirects

1 files changed, 2 insertions, 2 deletions

diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb
index f23343ddb..f63d6a508 100644
--- a/app/controllers/user_controller.rb
+++ b/app/controllers/user_controller.rb
@@ -256,7 +256,7 @@ class UserController < ApplicationController
     def signout
         self._do_signout
         if params[:r]
-            redirect_to params[:r]
+            redirect_to URI.parse(params[:r]).path
         else
             redirect_to :controller => "general", :action => "frontpage"
         end
@@ -596,7 +596,7 @@ class UserController < ApplicationController
         end
         @user.receive_email_alerts = params[:receive_email_alerts]
         @user.save!
-        redirect_to params[:came_from]
+        redirect_to URI.parse(params[:came_from]).path
     end
 
     private