fixed possible _next vulnerability

2013-07-23 02:06:42 -05:00
parent 2d59e86ab9
commit e6271dd5f1
2 changed files with 7 additions and 2 deletions
@@ -1 +1 @@
-Version 2.6.0-development+timestamp.2013.07.23.01.03.38
+Version 2.6.0-development+timestamp.2013.07.23.02.04.35
@@ -2046,7 +2046,12 @@ class Auth(object):
        ### pass

        if next is DEFAULT:
-            next = self.next or self.settings.login_next
+            # important for security
+            next = self.settings.login_next
+            if self.next:
+                host = self.next.split('//',1)[-1].split('/')[0]
+                if host in self.settings.cas_domains:
+                    next = self.next
        if onvalidation is DEFAULT:
            onvalidation = self.settings.login_onvalidation
        if onaccept is DEFAULT: