2009-11-13 Marek Habersack <[email protected]>

	* HttpResponse.cs: added parameter checks to Redirect ().
	If the passed url starts with http:, https:, file: or ftp: then it
	is treated as a fully qualified one and no attempt to rewrite the
	url to the fully qualified form (if system.web/httpRuntime
	UseFullyQualifiedRedirectUrl is true) is made.

svn path=/trunk/mcs/; revision=146092

mcs/class/System.Web/System.Web/ChangeLog

@@ -1,3 +1,11 @@
+2009-11-13  Marek Habersack  <[email protected]>
+
+	* HttpResponse.cs: added parameter checks to Redirect ().
+	If the passed url starts with http:, https:, file: or ftp: then it
+	is treated as a fully qualified one and no attempt to rewrite the
+	url to the fully qualified form (if system.web/httpRuntime
+	UseFullyQualifiedRedirectUrl is true) is made.
+
 2009-11-09  Marek Habersack  <[email protected]>
 
 	* HttpCookie.cs: made HttpCookie.CookieNVC serializable. Patch

mcs/class/System.Web/System.Web/HttpResponse.cs

@@ -839,25 +839,44 @@ namespace System.Web
 
 		public void Redirect (string url, bool endResponse)
 		{
+			if (url == null)
+				throw new ArgumentNullException ("url");
+			
 			if (headers_sent)
 				throw new HttpException ("Headers have already been sent");
 
+			if (url.IndexOf ('\n') != -1)
+				throw new ArgumentException ("Redirect URI cannot contain newline characters.", "url");
+			
 			is_request_being_redirected = true;
 			ClearHeaders ();
 			ClearContent ();
 			
 			StatusCode = 302;
 			url = ApplyAppPathModifier (url);
-			HttpRuntimeSection config = WebConfigurationManager.GetWebApplicationSection ("system.web/httpRuntime") as HttpRuntimeSection;
-			if (config != null && config.UseFullyQualifiedRedirectUrl) {
-				var ub = new UriBuilder (context.Request.Url);
-				ub.Path = url;
-				ub.Fragment = null;
-				ub.Password = null;
-				ub.Query = null;
-				ub.UserName = null;
-				url = ub.Uri.ToString ();
+
+			bool isFullyQualified;
+			if (StrUtils.StartsWith (url, "http:", true) ||
+			    StrUtils.StartsWith (url, "https:", true) ||
+			    StrUtils.StartsWith (url, "file:", true) ||
+			    StrUtils.StartsWith (url, "ftp:", true))
+				isFullyQualified = true;
+			else
+				isFullyQualified = false;
+
+			if (!isFullyQualified) {
+				HttpRuntimeSection config = WebConfigurationManager.GetWebApplicationSection ("system.web/httpRuntime") as HttpRuntimeSection;
+				if (config != null && config.UseFullyQualifiedRedirectUrl) {
+					var ub = new UriBuilder (context.Request.Url);
+					ub.Path = url;
+					ub.Fragment = null;
+					ub.Password = null;
+					ub.Query = null;
+					ub.UserName = null;
+					url = ub.Uri.ToString ();
+				}
 			}
+			
 			redirect_location = url;
 
 			// Text for browsers that can't handle location header