From 8b8baf10a35950f7932c118b2adc3bb9ed75e3d8 Mon Sep 17 00:00:00 2001 From: mdipierro Date: Fri, 13 Jun 2014 22:24:57 -0500 Subject: [PATCH] fixed issue 1942, redirect in federated login security check --- VERSION | 2 +- gluon/tools.py | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/VERSION b/VERSION index 23539bf3..80244627 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -Version 2.9.5-trunk+timestamp.2014.06.13.11.45.40 +Version 2.9.5-trunk+timestamp.2014.06.13.22.23.53 diff --git a/gluon/tools.py b/gluon/tools.py index fd3aade3..9bb00724 100644 --- a/gluon/tools.py +++ b/gluon/tools.py @@ -2330,7 +2330,8 @@ class Auth(object): ### use session for federated login snext = self.get_vars_next() if snext and self.settings.prevent_open_redirect_attacks: - if not snext.split('/')[2] == request.env.http_host: + items = snext.split('/') + if len(items)<2 or not items[2] == request.env.http_host: snext = None if snext: