Merge pull request #2210 from timnyborg/patch-5

prevent open redirects with no protocol specified
2019-05-25 00:21:20 -07:00
parent 22f95677d9 99d3d1d465
commit c02ee6a5c0
1 changed files with 1 additions and 1 deletions
@@ -1754,7 +1754,7 @@ class Auth(AuthAPI):
        # _next variable in the request.
        if next:
            parts = next.split('/')
-            if ':' not in parts[0]:
+            if ':' not in parts[0] and parts[:2] != ['', '']:
                return next
            elif len(parts) > 2 and parts[0].endswith(':') and parts[1:3] == ['', host]:
                return next