From 4a2549f49af44c12f03d957190948800f8614450 Mon Sep 17 00:00:00 2001
From: Hamza Farooq <42243411+HamzaIbnFarooq@users.noreply.github.com>
Date: Tue, 3 Aug 2021 17:29:23 +0500
Subject: [PATCH] fix: making LOGIN_REDIRECT_WHITELIST configurable through env
 files (#26760)

LOGIN_REDIRECT_WHITELIST has been used to filter redirect-url while processing logout requests but its configurations were not picked through environment files like lms.yml or studio.yml. This PR fixes that bug.
---
 cms/envs/production.py | 9 +++++++--
 lms/envs/common.py     | 4 ++++
 lms/envs/devstack.py   | 4 ++--
 lms/envs/production.py | 7 +++++++
 4 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/cms/envs/production.py b/cms/envs/production.py
index 5052473870..012c291232 100644
--- a/cms/envs/production.py
+++ b/cms/envs/production.py
@@ -276,8 +276,13 @@ if "TRACKING_IGNORE_URL_PATTERNS" in ENV_TOKENS:
 # Heartbeat
 HEARTBEAT_CELERY_ROUTING_KEY = ENV_TOKENS.get('HEARTBEAT_CELERY_ROUTING_KEY', HEARTBEAT_CELERY_ROUTING_KEY)
 
-LOGIN_REDIRECT_WHITELIST = [reverse_lazy('home')]
-
+# Sometimes, OAuth2 clients want the user to redirect back to their site after logout. But to determine if the given
+# redirect URL/path is safe for redirection, the following variable is used by edX.
+LOGIN_REDIRECT_WHITELIST = ENV_TOKENS.get(
+    'LOGIN_REDIRECT_WHITELIST',
+    LOGIN_REDIRECT_WHITELIST
+)
+LOGIN_REDIRECT_WHITELIST.extend([reverse_lazy('home')])
 
 ############### XBlock filesystem field config ##########
 if 'DJFS' in AUTH_TOKENS and AUTH_TOKENS['DJFS'] is not None:
diff --git a/lms/envs/common.py b/lms/envs/common.py
index e7b81e4d93..a89e2bf992 100644
--- a/lms/envs/common.py
+++ b/lms/envs/common.py
@@ -3378,6 +3378,10 @@ if FEATURES.get('ENABLE_CORS_HEADERS'):
 # to simulate cross-domain requests.
 XDOMAIN_PROXY_CACHE_TIMEOUT = 60 * 15
 
+# .. setting_name: LOGIN_REDIRECT_WHITELIST
+# .. setting_default: empty list ([])
+# .. setting_description: While logout, if logout request has a redirect-url as query strings,
+#   then the redirect-url is validated through LOGIN_REDIRECT_WHITELIST.
 LOGIN_REDIRECT_WHITELIST = []
 
 ###################### Registration ##################################
diff --git a/lms/envs/devstack.py b/lms/envs/devstack.py
index 4130c530e5..d28a1dd08f 100644
--- a/lms/envs/devstack.py
+++ b/lms/envs/devstack.py
@@ -256,7 +256,7 @@ CORS_ALLOW_HEADERS = corsheaders_default_headers + (
     'use-jwt-cookie',
 )
 
-LOGIN_REDIRECT_WHITELIST = [
+LOGIN_REDIRECT_WHITELIST.extend([
     CMS_BASE,
     # Allow redirection to all micro-frontends.
     # Please add your MFE if is not already listed here.
@@ -272,7 +272,7 @@ LOGIN_REDIRECT_WHITELIST = [
     'localhost:18400',  # frontend-app-publisher
     ENTERPRISE_LEARNER_PORTAL_NETLOC,  # frontend-app-learner-portal-enterprise
     ENTERPRISE_ADMIN_PORTAL_NETLOC,  # frontend-app-admin-portal
-]
+])
 
 ###################### JWTs ######################
 JWT_AUTH.update({
diff --git a/lms/envs/production.py b/lms/envs/production.py
index d4c4b62db1..9ede3006ac 100644
--- a/lms/envs/production.py
+++ b/lms/envs/production.py
@@ -182,6 +182,13 @@ ALLOWED_HOSTS = [
     FEATURES['PREVIEW_LMS_BASE'],
 ]
 
+# Sometimes, OAuth2 clients want the user to redirect back to their site after logout. But to determine if the given
+# redirect URL/path is safe for redirection, the following variable is used by edX.
+LOGIN_REDIRECT_WHITELIST = ENV_TOKENS.get(
+    'LOGIN_REDIRECT_WHITELIST',
+    LOGIN_REDIRECT_WHITELIST
+)
+
 # allow for environments to specify what cookie name our login subsystem should use
 # this is to fix a bug regarding simultaneous logins between edx.org and edge.edx.org which can
 # happen with some browsers (e.g. Firefox)