innov
/
django1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

Fixed #12534 -- Loosened the the security check for "next" redirects after logins slightly to allow paths that contain spaces. Thanks for the patch, jnns and aaugustin. 

git-svn-id: http://code.djangoproject.com/svn/django/trunk@15702 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Jannis Leidel 2011-03-01 22:49:18 +00:00
parent be4a2e3f3e
commit ec193224d3
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
django/contrib/auth/tests/views.py
View File

@ -236,7 +236,9 @@ class LoginTest(AuthViewsTestCase):
'/view?param=ftp://exampel.com', '/view?param=ftp://exampel.com',
'view/?param=//example.com', 'view/?param=//example.com',
'https:///', 'https:///',
'//testserver/'): '//testserver/',
'/url%20with%20spaces/', # see ticket #12534
):
safe_url = '%(url)s?%(next)s=%(good_url)s' % { safe_url = '%(url)s?%(next)s=%(good_url)s' % {
'url': login_url, 'url': login_url,
'next': REDIRECT_FIELD_NAME, 'next': REDIRECT_FIELD_NAME,
@ -251,6 +253,7 @@ class LoginTest(AuthViewsTestCase):
self.assertTrue(good_url in response['Location'], self.assertTrue(good_url in response['Location'],
"%s should be allowed" % good_url) "%s should be allowed" % good_url)
class LoginURLSettings(AuthViewsTestCase): class LoginURLSettings(AuthViewsTestCase):
urls = 'django.contrib.auth.tests.urls' urls = 'django.contrib.auth.tests.urls'

6
django/contrib/auth/views.py
View File

@ -34,11 +34,11 @@ def login(request, template_name='registration/login.html',
if form.is_valid(): if form.is_valid():
netloc = urlparse.urlparse(redirect_to)[1] netloc = urlparse.urlparse(redirect_to)[1]
# Light security check -- make sure redirect_to isn't garbage. # Use default setting if redirect_to is empty
if not redirect_to or ' ' in redirect_to: if not redirect_to:
redirect_to = settings.LOGIN_REDIRECT_URL redirect_to = settings.LOGIN_REDIRECT_URL
# Heavier security check -- don't allow redirection to a different # Security check -- don't allow redirection to a different
# host. # host.
elif netloc and netloc != request.get_host(): elif netloc and netloc != request.get_host():
redirect_to = settings.LOGIN_REDIRECT_URL redirect_to = settings.LOGIN_REDIRECT_URL