From 75700f06a92c706fa0173e10f52c62682ca62a8e Mon Sep 17 00:00:00 2001
From: Devin Howard <devin@callysto.com>
Date: Tue, 3 Nov 2015 22:22:53 +0800
Subject: [PATCH] make invite link use REQUEST_URI

---
 app/controllers/application_controller.rb | 11 +++++++++--
 app/views/layouts/_lightboxes.html.erb    |  5 ++---
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 0a3d12ab..d275eaea 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -1,5 +1,7 @@
 class ApplicationController < ActionController::Base
   protect_from_forgery
+
+  before_filter :get_invite_link
   
   # this is for global login
   include ContentHelper
@@ -47,7 +49,6 @@ private
     current_user
   end
   
-    
   def authenticated?
     current_user
   end
@@ -55,5 +56,11 @@ private
   def admin?
     current_user && current_user.admin
   end
-  
+
+  def get_invite_link
+    unsafe_uri = request.env["REQUEST_URI"]
+    valid_url = /^https?:\/\/([\w\.-]+)(:\d{1,5})?\/?$/
+    safe_uri = (unsafe_uri.match(valid_url)) ? unsafe_uri : "http://metamaps.cc/"
+    @invite_link = "#{safe_uri}join?code=#{current_user.code}"
+  end
 end
diff --git a/app/views/layouts/_lightboxes.html.erb b/app/views/layouts/_lightboxes.html.erb
index e8b688d5..46ab2edf 100644
--- a/app/views/layouts/_lightboxes.html.erb
+++ b/app/views/layouts/_lightboxes.html.erb
@@ -231,9 +231,8 @@
 <p>As a valued beta tester, you have the ability to invite your peers, colleagues and collaborators onto the platform.</p>
 <p>Below is a personal invite link containing your unique access code, which can be used multiple times.</p>
             <div id="joinCodesBox">
-            <% mapper = current_user %>
-            <p class="joinCodes">http://metamaps.cc/join?code=<%= mapper.code %></p>
-            <button class="button" onclick="Metamaps.GlobalUI.shareInvite('http://metamaps.cc/join?code=<%= mapper.code %>');">COPY INVITE LINK!</button>
+            <p class="joinCodes"><%= @invite_link %>
+            <button class="button" onclick="Metamaps.GlobalUI.shareInvite('<%= @invite_link %>');">COPY INVITE LINK!</button>
             </div>
             
         </div>