OTWO-7717 Open redirect via referer header redirect_back uses allow_o…

[Niharika1117]

…ther_host: true

[Copilot]

Pull request overview

This PR hardens controller redirection logic to prevent open redirects via the Referer header by disallowing cross-host redirect_back targets, and adds regression tests to cover the behavior.

Changes:

• Set allow_other_host: false on redirect_back usages in ProjectsController and OrgFilters.
• Force redirect_to_saved_path to disallow cross-host redirects.
• Add controller tests asserting external-Referer redirects fall back to safe internal locations.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/controllers/projects_controller_test.rb	Adds regression tests for safe redirect_back behavior in report_outdated.
test/controllers/organizations_controller_test.rb	Adds regression test ensuring unauthorized flow doesn’t redirect to external Referer.
test/controllers/application_controller_test.rb	Adds tests for redirect_to_saved_path redirect safety (and a test-only route/action).
app/controllers/projects_controller.rb	Disallows cross-host redirects when redirecting back from report_outdated.
app/controllers/concerns/org_filters.rb	Disallows cross-host redirects in the unauthorized org edit flow.
app/controllers/application_controller.rb	Forces redirect_to_saved_path to disallow cross-host redirects.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.