dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed possible _next vulnerability

Browse Source
This commit is contained in:
mdipierro
2013-07-23 02:06:42 -05:00
parent 2d59e86ab9
commit e6271dd5f1
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VERSION
+1 -1
View File
@@ -1 +1 @@
Version 2.6.0-development+timestamp.2013.07.23.01.03.38 Version 2.6.0-development+timestamp.2013.07.23.02.04.35
gluon/tools.py
+6 -1
View File
@@ -2046,7 +2046,12 @@ class Auth(object):
### pass ### pass
if next is DEFAULT: if next is DEFAULT:
next = self.next or self.settings.login_next # important for security
next = self.settings.login_next
if self.next:
host = self.next.split('//',1)[-1].split('/')[0]
if host in self.settings.cas_domains:
next = self.next
if onvalidation is DEFAULT: if onvalidation is DEFAULT:
onvalidation = self.settings.login_onvalidation onvalidation = self.settings.login_onvalidation
if onaccept is DEFAULT: if onaccept is DEFAULT: