[12.x] Allow relative urls for redirect

.github/workflows/tests.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   tests:
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-18.04
     strategy:
       fail-fast: true
       matrix:

resources/views/payment.blade.php

@@ -108,7 +108,7 @@ class="inline-block w-full px-4 py-3 mb-4 text-white rounded-lg hover:bg-blue-50
                     </div>
                 @endif
 
-                <button @click="goBack" ref="goBackButton" data-redirect="{{ $redirect ?? url('/') }}"
+                <button @click="goBack" ref="goBackButton" data-redirect="{{ $redirect }}"
                    class="inline-block w-full px-4 py-3 bg-gray-200 hover:bg-gray-300 text-center text-gray-700 rounded-lg">
                     {{ __('Go back') }}
                 </button>

src/Http/Controllers/PaymentController.php

@@ -24,7 +24,7 @@ public function __construct()
      * Display the form to gather additional payment verification for the given payment.
      *
      * @param  string  $id
-     * @return \Illuminate\View\View
+     * @return \Illuminate\Contracts\View\View
      */
     public function show($id)
     {
@@ -33,7 +33,7 @@ public function show($id)
             'payment' => new Payment(
                 StripePaymentIntent::retrieve($id, Cashier::stripeOptions())
             ),
-            'redirect' => request('redirect'),
+            'redirect' => url(request('redirect', '/')),
         ]);
     }
 }

src/Http/Middleware/VerifyRedirectUrl.php

@@ -22,7 +22,7 @@ public function handle($request, Closure $next)
 
         $url = parse_url($redirect);
 
-        if ($redirect && (! isset($url['host']) || $url['host'] !== $request->getHost())) {
+        if (isset($url['host']) && $url['host'] !== $request->getHost()) {
             throw new AccessDeniedHttpException('Redirect host mismatch.');
         }
 

tests/Unit/VerifyRedirectUrlTest.php

@@ -33,16 +33,16 @@ public function test_it_fails_on_host_mismatch()
         });
     }
 
-    public function test_it_fails_when_the_url_is_invalid()
+    public function test_it_passes_for_relative_urls()
     {
-        $request = Request::create('http://baz.com/stripe/payment', 'GET', ['redirect' => 'foo/bar']);
+        $request = Request::create('http://baz.com/stripe/payment', 'GET', ['redirect' => '/foo/bar']);
         $middleware = new VerifyRedirectUrl;
 
-        $this->expectException(AccessDeniedHttpException::class);
-
-        $middleware->handle($request, function () {
-            //
+        $response = $middleware->handle($request, function () {
+            return 'Hello World!';
         });
+
+        $this->assertSame('Hello World!', $response);
     }
 
     public function test_it_is_skipped_when_no_redirect_is_present()