diff --git a/django/utils/http.py b/django/utils/http.py index 07b6ae246a..c13f44602b 100644 --- a/django/utils/http.py +++ b/django/utils/http.py @@ -3,7 +3,6 @@ import calendar import datetime import re import unicodedata -import warnings from binascii import Error as BinasciiError from email.utils import formatdate from urllib.parse import ( @@ -14,7 +13,6 @@ from urllib.parse import ( from django.core.exceptions import TooManyFieldsSent from django.utils.datastructures import MultiValueDict -from django.utils.deprecation import RemovedInDjango21Warning from django.utils.encoding import force_bytes from django.utils.functional import keep_lazy_text @@ -264,7 +262,7 @@ def is_same_domain(host, pattern): ) -def is_safe_url(url, host=None, allowed_hosts=None, require_https=False): +def is_safe_url(url, allowed_hosts=None, require_https=False): """ Return ``True`` if the url is a safe redirection (i.e. it doesn't point to a different host and uses a safe scheme). @@ -280,14 +278,6 @@ def is_safe_url(url, host=None, allowed_hosts=None, require_https=False): return False if allowed_hosts is None: allowed_hosts = set() - if host: - warnings.warn( - "The host argument is deprecated, use allowed_hosts instead.", - RemovedInDjango21Warning, - stacklevel=2, - ) - # Avoid mutating the passed in allowed_hosts. - allowed_hosts = allowed_hosts | {host} # Chrome treats \ completely as / in paths but it could be part of some # basic auth credentials so we need to check both URLs. return (_is_safe_url(url, allowed_hosts, require_https=require_https) and diff --git a/docs/releases/2.1.txt b/docs/releases/2.1.txt index 1fd22da588..6ab9303ccb 100644 --- a/docs/releases/2.1.txt +++ b/docs/releases/2.1.txt @@ -239,3 +239,5 @@ how to remove usage of these features. * ``django.core.cache.backends.memcached.PyLibMCCache`` no longer supports passing ``pylibmc`` behavior settings as top-level attributes of ``OPTIONS``. + +* The ``host`` parameter of ``django.utils.http.is_safe_url()`` is removed. diff --git a/tests/utils_tests/test_http.py b/tests/utils_tests/test_http.py index 5ce91c3728..04c2d55380 100644 --- a/tests/utils_tests/test_http.py +++ b/tests/utils_tests/test_http.py @@ -1,10 +1,8 @@ import unittest from datetime import datetime -from django.test import ignore_warnings from django.utils import http from django.utils.datastructures import MultiValueDict -from django.utils.deprecation import RemovedInDjango21Warning class TestUtilsHttp(unittest.TestCase): @@ -107,8 +105,6 @@ class TestUtilsHttp(unittest.TestCase): 'http://2001:cdba:0000:0000:0000:0000:3257:9652]/', ) for bad_url in bad_urls: - with ignore_warnings(category=RemovedInDjango21Warning): - self.assertFalse(http.is_safe_url(bad_url, host='testserver'), "%s should be blocked" % bad_url) self.assertFalse( http.is_safe_url(bad_url, allowed_hosts={'testserver', 'testserver2'}), "%s should be blocked" % bad_url, @@ -127,8 +123,6 @@ class TestUtilsHttp(unittest.TestCase): 'path/http:2222222222', ) for good_url in good_urls: - with ignore_warnings(category=RemovedInDjango21Warning): - self.assertTrue(http.is_safe_url(good_url, host='testserver'), "%s should be allowed" % good_url) self.assertTrue( http.is_safe_url(good_url, allowed_hosts={'otherserver', 'testserver'}), "%s should be allowed" % good_url,