dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed issue 1942, redirect in federated login security check

Browse Source
This commit is contained in:
mdipierro
2014-06-13 22:24:57 -05:00
parent e42b835687
commit 8b8baf10a3
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VERSION
+1 -1
View File
@@ -1 +1 @@
Version 2.9.5-trunk+timestamp.2014.06.13.11.45.40 Version 2.9.5-trunk+timestamp.2014.06.13.22.23.53
gluon/tools.py
+2 -1
View File
@@ -2330,7 +2330,8 @@ class Auth(object):
### use session for federated login ### use session for federated login
snext = self.get_vars_next() snext = self.get_vars_next()
if snext and self.settings.prevent_open_redirect_attacks: if snext and self.settings.prevent_open_redirect_attacks:
if not snext.split('/')[2] == request.env.http_host: items = snext.split('/')
if len(items)<2 or not items[2] == request.env.http_host:
snext = None snext = None
if snext: if snext: