From 6c1e5511fcd6abe99a164223d394a1831098d924 Mon Sep 17 00:00:00 2001
From: Kevin Ansfield <kevin@lookingsideways.co.uk>
Date: Mon, 28 May 2018 11:18:34 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20Fixed=20infinite=20redirect=20wh?=
 =?UTF-8?q?en=20subdirectory=20equals=20top=20level=20domain=20(#9621)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

closes https://github.com/TryGhost/Ghost/issues/9620

- adjust the `deduplicateSubDir` function's regex to only match duplicate subdirectories when the `url` is only a path rather than full url or the duplicate match starts with a `/`
---
 core/server/services/url/utils.js           | 6 ++++--
 core/server/web/middleware/url-redirects.js | 2 +-
 core/test/unit/services/url/utils_spec.js   | 6 ++++++
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/core/server/services/url/utils.js b/core/server/services/url/utils.js
index cb1406c253..88a9322976 100644
--- a/core/server/services/url/utils.js
+++ b/core/server/services/url/utils.js
@@ -63,9 +63,11 @@ function deduplicateSubDir(url) {
     }
 
     subDir = subDir.replace(/^\/|\/+$/, '');
-    subDirRegex = new RegExp(subDir + '\/' + subDir + '\/');
+    // we can have subdirs that match TLDs so we need to restrict matches to
+    // duplicates that start with a / or the beginning of the url
+    subDirRegex = new RegExp('(^|\/)' + subDir + '\/' + subDir + '\/');
 
-    return url.replace(subDirRegex, subDir + '/');
+    return url.replace(subDirRegex, '$1' + subDir + '/');
 }
 
 function getProtectedSlugs() {
diff --git a/core/server/web/middleware/url-redirects.js b/core/server/web/middleware/url-redirects.js
index 88b8190bb7..daa992b193 100644
--- a/core/server/web/middleware/url-redirects.js
+++ b/core/server/web/middleware/url-redirects.js
@@ -37,7 +37,7 @@ _private.getAdminRedirectUrl = function getAdminRedirectUrl(options) {
         queryParameters = options.queryParameters,
         secure = options.secure;
 
-    debug('getAdminRedirectUrl', requestedHost, requestedUrl, adminHostWithProtocol);
+    debug('getAdminRedirectUrl', requestedHost, requestedUrl, adminHostWithoutProtocol, blogHostWithoutProtocol, urlService.utils.urlJoin(blogHostWithoutProtocol, 'ghost/'));
 
     // CASE: we only redirect the admin access if `admin.url` is configured
     // If url and admin.url are not equal AND the requested host does not match, redirect.
diff --git a/core/test/unit/services/url/utils_spec.js b/core/test/unit/services/url/utils_spec.js
index c048fad9c6..d29c58b6b9 100644
--- a/core/test/unit/services/url/utils_spec.js
+++ b/core/test/unit/services/url/utils_spec.js
@@ -92,6 +92,12 @@ describe('Url', function () {
             urlService.utils.urlJoin('my/blog', 'my/blog/about').should.equal('my/blog/about');
             urlService.utils.urlJoin('my/blog/', 'my/blog/about').should.equal('my/blog/about');
         });
+
+        it('should handle subdir matching tld', function () {
+            configUtils.set({url: 'http://ghost.blog/blog'});
+            urlService.utils.urlJoin('ghost.blog/blog', 'ghost/').should.equal('ghost.blog/blog/ghost/');
+            urlService.utils.urlJoin('ghost.blog', 'blog', 'ghost/').should.equal('ghost.blog/blog/ghost/');
+        });
     });
 
     describe('urlFor', function () {