From e62968d5e154fd1c7ad3ba0e05866381ad245828 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Carlos=20Andr=C3=A9s=20Rocha?= Date: Wed, 3 Oct 2012 17:16:22 -0400 Subject: [PATCH] Get OpenID XRDS url host from request Replaced the previous method of getting it from HTTP_POST to use django's mechanism, which may or may not use HTTP_HOST. However if an attacker changes the request header, there is not much he can do since he cannot recreate the association nonce. --- common/djangoapps/external_auth/views.py | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/common/djangoapps/external_auth/views.py b/common/djangoapps/external_auth/views.py index a43645bf1d..6f1e0bc5c4 100644 --- a/common/djangoapps/external_auth/views.py +++ b/common/djangoapps/external_auth/views.py @@ -271,10 +271,7 @@ def get_xrds_url(resource, request): """ Return the XRDS url for a resource """ - host = request.META['HTTP_HOST'] - - if not host.endswith('edx.org'): - return None + host = request.get_host() location = host + '/openid/provider/' + resource + '/'