From 4596b32a0787a574881284d042bb77c970df8a4d Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 4 Jul 2026 01:25:24 +0200 Subject: Fix safe_return_to being uncallable from controllers Defined only in ApplicationHelper, which Rails auto-mixes into views but not controllers - so events#create and events#update, which call it directly, have been broken since introduction. Likely unexercised until now because every existing event was created via node.events.create! in the seed script, never through a real POST. Moved to ApplicationController as a protected method + helper_method declaration, so both controllers and views can call it (form_error_ messages stays in ApplicationHelper - it's genuinely view-only, content_tag isn't available in a controller either). Logic unchanged, caught by the new EventsController tests in the previous commit. --- app/controllers/application_controller.rb | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'app/controllers') diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 75f92c3..cbeb40d 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -5,6 +5,8 @@ class ApplicationController < ActionController::Base before_action :set_locale + helper_method :safe_return_to + protected def set_locale @@ -18,4 +20,14 @@ class ApplicationController < ActionController::Base def default_url_options { locale: I18n.locale == I18n.default_locale ? nil : I18n.locale } end + + def safe_return_to(url) + return events_path if url.blank? + uri = URI.parse(url) + return events_path if uri.host.present? + return events_path unless url.start_with?('/') + url + rescue URI::InvalidURIError + events_path + end end -- cgit v1.3