Andal.LND/edx-platform
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #18329 from edx/bmedx/is_safe_url_allowed_hosts

Browse Source 
Change usages of is_safe_url to use new allowed_hosts instead of host
This commit is contained in:
Brian Mesick
2018-06-07 10:06:40 -04:00
committed by GitHub
parent 9f820c9e71 29ad5fce6f
commit ca0ec641db
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
common/djangoapps/student/helpers.py
View File

@@ -329,7 +329,7 @@ def get_redirect_to(request):
# get information about a user on edx.org. In any such case drop the parameter. # get information about a user on edx.org. In any such case drop the parameter.
if redirect_to: if redirect_to:
mime_type, _ = mimetypes.guess_type(redirect_to, strict=False) mime_type, _ = mimetypes.guess_type(redirect_to, strict=False)
if not http.is_safe_url(redirect_to, host=request.get_host()): if not http.is_safe_url(redirect_to, allowed_hosts={request.get_host()}):
log.warning( log.warning(
u'Unsafe redirect parameter detected after login page: %(redirect_to)r', u'Unsafe redirect parameter detected after login page: %(redirect_to)r',
{"redirect_to": redirect_to} {"redirect_to": redirect_to}

2
common/djangoapps/student/views/login.py
View File

@@ -747,7 +747,7 @@ class LogoutView(TemplateView):
""" """
target_url = self.request.GET.get('redirect_url') target_url = self.request.GET.get('redirect_url')
if target_url and is_safe_url(target_url, self.request.META.get('HTTP_HOST')): if target_url and is_safe_url(target_url, allowed_hosts={self.request.META.get('HTTP_HOST')}):
return target_url return target_url
else: else:
return self.default_target return self.default_target

2
openedx/core/djangoapps/external_auth/views.py
View File

@@ -556,7 +556,7 @@ def _safe_postlogin_redirect(redirect_to, safehost, default_redirect='/'):
@param safehost: which host is safe to redirect to @param safehost: which host is safe to redirect to
@return: an HttpResponseRedirect @return: an HttpResponseRedirect
""" """
if is_safe_url(url=redirect_to, host=safehost): if is_safe_url(url=redirect_to, allowed_hosts={safehost}):
return redirect(redirect_to) return redirect(redirect_to)
return redirect(default_redirect) return redirect(default_redirect)