Projet

Général

Profil

0001-utils-always-encode-next_url-to-ASCII-before-using-i.patch

Benjamin Dauvergne, 21 novembre 2017 10:41

Télécharger (3,12 ko)

Voir les différences:

Subject: [PATCH] utils: always encode next_url to ASCII before using it (fixes
 #20181)

 src/authentic2/utils.py | 33 +++++++++++++++++++++++----------
 1 file changed, 23 insertions(+), 10 deletions(-)
src/authentic2/utils.py
306 306
            url = request.build_absolute_uri(url)
307 307
        else:
308 308
            raise TypeError('make_url() absolute cannot be used without request')
309
    return url
309
    # URL must be ASCII, always
310
    return url.encode('ascii')
310 311

  
311 312

  
312 313
# improvement over django.shortcuts.redirect
......
332 333

  
333 334
def continue_to_next_url(request, keep_params=True, include=(constants.NONCE_FIELD_NAME,),
334 335
                         **kwargs):
335
    next_url = request.POST.get(REDIRECT_FIELD_NAME)
336
    next_url = next_url or request.GET.get(REDIRECT_FIELD_NAME)
337
    next_url = next_url or settings.LOGIN_REDIRECT_URL
336
    next_url = select_next_url(request, settings.LOGIN_REDIRECT_URL, include_post=True)
338 337
    return redirect(request, to=next_url, keep_params=keep_params, include=include, **kwargs)
339 338

  
340 339

  
......
646 645

  
647 646

  
648 647
def get_registration_url(request, service_slug=None):
649
    if REDIRECT_FIELD_NAME in request.GET and is_valid_url(request.GET[REDIRECT_FIELD_NAME]):
650
        next_url = request.GET.get(REDIRECT_FIELD_NAME)
651
    else:
652
        next_url = make_url(settings.LOGIN_REDIRECT_URL)
648
    next_url = select_next_url(request, settings.LOGIN_REDIRECT_URL)
653 649
    next_url = make_url(next_url, request=request, keep_params=True,
654 650
                        include=(constants.NONCE_FIELD_NAME,), resolve=False)
655 651
    params = {REDIRECT_FIELD_NAME: next_url}
......
866 862
    return False
867 863

  
868 864

  
869
def select_next_url(request, default):
865
def get_next_url(params):
866
    '''Extract and decode a next_url field'''
867
    next_url = params.get(REDIRECT_FIELD_NAME)
868
    if not next_url:
869
        return None
870
    try:
871
        next_url = next_url.encode('ascii')
872
    except UnicodeEncodeError:
873
        return None
874
    if not is_valid_url(next_url):
875
        return None
876
    return next_url
877

  
878

  
879
def select_next_url(request, default, include_post=False):
870 880
    '''Select the first valid next URL'''
871
    next_url = request.GET.get(REDIRECT_FIELD_NAME)
881
    next_url = (include_post and get_next_url(request.POST)) or get_next_url(request.GET)
872 882
    if good_next_url(request, next_url):
873 883
        return next_url
874 884
    return default
......
930 940
    if domain1 == domain2:
931 941
        return True
932 942

  
943
    if not domain1 or not domain2:
944
        return False
945

  
933 946
    if domain2.startswith('.'):
934 947
        # p1 is a sub-domain or the base domain
935 948
        if domain1.endswith(domain2) or domain1 == domain2[1:]:
936
-