make invite link use REQUEST_URI

app/controllers/application_controller.rb

@@ -1,6 +1,8 @@
 class ApplicationController < ActionController::Base
   protect_from_forgery
 
+  before_filter :get_invite_link
+  
   # this is for global login
   include ContentHelper
   
@@ -47,7 +49,6 @@ private
     current_user
   end
   
-    
   def authenticated?
     current_user
   end
@@ -56,4 +57,10 @@ private
     current_user && current_user.admin
   end
 
+  def get_invite_link
+    unsafe_uri = request.env["REQUEST_URI"]
+    valid_url = /^https?:\/\/([\w\.-]+)(:\d{1,5})?\/?$/
+    safe_uri = (unsafe_uri.match(valid_url)) ? unsafe_uri : "http://metamaps.cc/"
+    @invite_link = "#{safe_uri}join?code=#{current_user.code}"
+  end
 end

app/views/layouts/_lightboxes.html.erb

@@ -231,9 +231,8 @@
 <p>As a valued beta tester, you have the ability to invite your peers, colleagues and collaborators onto the platform.</p>
 <p>Below is a personal invite link containing your unique access code, which can be used multiple times.</p>
             <div id="joinCodesBox">
-            <% mapper = current_user %>
-            <p class="joinCodes">http://metamaps.cc/join?code=<%= mapper.code %></p>
-            <button class="button" onclick="Metamaps.GlobalUI.shareInvite('http://metamaps.cc/join?code=<%= mapper.code %>');">COPY INVITE LINK!</button>
+            <p class="joinCodes"><%= @invite_link %>
+            <button class="button" onclick="Metamaps.GlobalUI.shareInvite('<%= @invite_link %>');">COPY INVITE LINK!</button>
             </div>
             
         </div>