dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix next redirect if only one / exists

Browse Source
This commit is contained in:
Alex Artigues
2016-06-29 20:54:13 -04:00
parent 5f80300c5d
commit f87c3e260c
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gluon/tools.py
+7 -5
View File
@@ -1918,11 +1918,13 @@ class Auth(object):
if isinstance(next, (list, tuple)): if isinstance(next, (list, tuple)):
next = next[0] next = next[0]
if next and self.settings.prevent_open_redirect_attacks: if next and self.settings.prevent_open_redirect_attacks:
# Prevent an attacker from adding an arbitrary url after the # Prevent an attacker from adding an arbitrary url after the _next variable in the request.
# _next variable in the request. # Browsers will fix a single / so check multiple things just in case
items = next.split('/') items = filter(None, next.split('/'))
if '//' in next and items[2] != current.request.env.http_host: has_url = any(x in next for x in ['//', ':', 'ftp', 'http', 'rss', 'xml'])
next = None if has_url and len(items) > 1:
if items[1] != current.request.env.http_host:
next = None
return next return next
def _get_user_id(self): def _get_user_id(self):