From 3714342fb7e18697ddb8a3cd70c6e4cc47a34a59 Mon Sep 17 00:00:00 2001
From: amercader <amercadero@gmail.com>
Date: Fri, 14 Jun 2019 14:10:02 +0200
Subject: [PATCH 1/4] [#4842] Move primer endpoint to new util blueprint

---
 ckan/config/routing.py   |  1 -
 ckan/controllers/util.py |  5 -----
 ckan/views/util.py       | 27 +++++++++++++++++++++++++++
 3 files changed, 27 insertions(+), 6 deletions(-)
 create mode 100644 ckan/views/util.py

diff --git a/ckan/config/routing.py b/ckan/config/routing.py
index 0332214fb97..248477a636c 100644
--- a/ckan/config/routing.py
+++ b/ckan/config/routing.py
@@ -137,7 +137,6 @@ def make_map():
     with SubMapper(map, controller='util') as m:
         m.connect('/i18n/strings_{lang}.js', action='i18n_js_strings')
         m.connect('/util/redirect', action='redirect')
-        m.connect('/testing/primer', action='primer')
 
     # robots.txt
     map.connect('/(robots.txt)', controller='template', action='view')
diff --git a/ckan/controllers/util.py b/ckan/controllers/util.py
index 0f84ebe933f..db50238f217 100644
--- a/ckan/controllers/util.py
+++ b/ckan/controllers/util.py
@@ -22,11 +22,6 @@ def redirect(self):
         else:
             base.abort(403, _('Redirecting to external site is not allowed.'))
 
-    def primer(self):
-        ''' Render all html components out onto a single page.
-        This is useful for development/styling of ckan. '''
-        return base.render('development/primer.html')
-
     def i18_js_strings(self, lang):
         ''' This is used to produce the translations for javascript. '''
         i18n.set_lang(lang)
diff --git a/ckan/views/util.py b/ckan/views/util.py
new file mode 100644
index 00000000000..c038e6b804f
--- /dev/null
+++ b/ckan/views/util.py
@@ -0,0 +1,27 @@
+# encoding: utf-8
+
+import re
+
+from flask import Blueprint
+
+import ckan.lib.base as base
+
+from ckan.common import g, config, _
+
+
+util = Blueprint(u'util', __name__)
+
+
+def primer():
+    u''' Render all HTML components out onto a single page.
+    This is useful for development/styling of CKAN. '''
+
+    return base.render(u'development/primer.html')
+
+
+util_rules = [
+    (u'/testing/primer', primer),
+]
+
+for rule, view_func in util_rules:
+    util.add_url_rule(rule, view_func=view_func)

From 03c8242006a210e8909ece39157786f8e81b77f4 Mon Sep 17 00:00:00 2001
From: amercader <amercadero@gmail.com>
Date: Fri, 14 Jun 2019 16:08:06 +0200
Subject: [PATCH 2/4] [#4842] [#4842] Move internal redirect endpoint

---
 ckan/config/routing.py                        |  1 -
 .../templates/snippets/language_selector.html |  2 +-
 ckan/views/util.py                            | 25 +++++++++++++------
 3 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/ckan/config/routing.py b/ckan/config/routing.py
index 248477a636c..861bcb88e31 100644
--- a/ckan/config/routing.py
+++ b/ckan/config/routing.py
@@ -136,7 +136,6 @@ def make_map():
 
     with SubMapper(map, controller='util') as m:
         m.connect('/i18n/strings_{lang}.js', action='i18n_js_strings')
-        m.connect('/util/redirect', action='redirect')
 
     # robots.txt
     map.connect('/(robots.txt)', controller='template', action='view')
diff --git a/ckan/templates/snippets/language_selector.html b/ckan/templates/snippets/language_selector.html
index a092949b349..ae95e27fd43 100644
--- a/ckan/templates/snippets/language_selector.html
+++ b/ckan/templates/snippets/language_selector.html
@@ -1,5 +1,5 @@
 {% set current_lang = request.environ.CKAN_LANG %}
-<form class="form-inline form-select lang-select" action="{% url_for controller='util', action='redirect' %}" data-module="select-switch" method="POST">
+<form class="form-inline form-select lang-select" action="{% url_for 'util.internal_redirect' %}" data-module="select-switch" method="POST">
   <label for="field-lang-select">{{ _('Language') }}</label>
   <select id="field-lang-select" name="url" data-module="autocomplete" data-module-dropdown-class="lang-dropdown" data-module-container-class="lang-container">
     {% for locale in h.get_available_locales() %}
diff --git a/ckan/views/util.py b/ckan/views/util.py
index c038e6b804f..12001f9e570 100644
--- a/ckan/views/util.py
+++ b/ckan/views/util.py
@@ -5,12 +5,24 @@
 from flask import Blueprint
 
 import ckan.lib.base as base
-
-from ckan.common import g, config, _
+import ckan.lib.helpers as h
+from ckan.common import _, request
 
 
 util = Blueprint(u'util', __name__)
 
+def internal_redirect():
+    ''' redirect to the url parameter. '''
+
+    url = request.form.get('url')
+    if not url:
+        base.abort(400, _('Missing Value') + ': url')
+
+    if h.url_is_local(url):
+        return h.redirect_to(url)
+    else:
+        base.abort(403, _('Redirecting to external site is not allowed.'))
+
 
 def primer():
     u''' Render all HTML components out onto a single page.
@@ -19,9 +31,6 @@ def primer():
     return base.render(u'development/primer.html')
 
 
-util_rules = [
-    (u'/testing/primer', primer),
-]
-
-for rule, view_func in util_rules:
-    util.add_url_rule(rule, view_func=view_func)
+util.add_url_rule(
+    u'/util/redirect', view_func=internal_redirect, methods=(u'POST',))
+util.add_url_rule(u'/testing/primer', view_func=primer)

From a2e4d8ec49945c8b36d7e2dd022defd9d5f81324 Mon Sep 17 00:00:00 2001
From: amercader <amercadero@gmail.com>
Date: Fri, 14 Jun 2019 16:09:01 +0200
Subject: [PATCH 3/4] [#4842] Remove old util controller

This controller is very unlikely to be extended from an extension.
i18_js_strings was unused AFAICT
---
 ckan/config/routing.py   |  3 ---
 ckan/controllers/util.py | 32 --------------------------------
 2 files changed, 35 deletions(-)
 delete mode 100644 ckan/controllers/util.py

diff --git a/ckan/config/routing.py b/ckan/config/routing.py
index 861bcb88e31..97338269eec 100644
--- a/ckan/config/routing.py
+++ b/ckan/config/routing.py
@@ -134,9 +134,6 @@ def make_map():
     # users
     map.redirect('/users/{url:.*}', '/user/{url}')
 
-    with SubMapper(map, controller='util') as m:
-        m.connect('/i18n/strings_{lang}.js', action='i18n_js_strings')
-
     # robots.txt
     map.connect('/(robots.txt)', controller='template', action='view')
 
diff --git a/ckan/controllers/util.py b/ckan/controllers/util.py
deleted file mode 100644
index db50238f217..00000000000
--- a/ckan/controllers/util.py
+++ /dev/null
@@ -1,32 +0,0 @@
-# encoding: utf-8
-
-import re
-
-import ckan.lib.base as base
-import ckan.lib.i18n as i18n
-import ckan.lib.helpers as h
-from ckan.common import _
-
-
-class UtilController(base.BaseController):
-    ''' Controller for functionality that has no real home'''
-
-    def redirect(self):
-        ''' redirect to the url parameter. '''
-        url = base.request.params.get('url')
-        if not url:
-            base.abort(400, _('Missing Value') + ': url')
-
-        if h.url_is_local(url):
-            return h.redirect_to(url)
-        else:
-            base.abort(403, _('Redirecting to external site is not allowed.'))
-
-    def i18_js_strings(self, lang):
-        ''' This is used to produce the translations for javascript. '''
-        i18n.set_lang(lang)
-        html = base.render('js_strings.html', cache_force=True)
-        html = re.sub(r'<[^\>]*>', '', html)
-        header = "text/javascript; charset=utf-8"
-        base.response.headers['Content-type'] = header
-        return html

From c31c68df74bc024e0eb9d5e8c5c0ff57b7651b13 Mon Sep 17 00:00:00 2001
From: amercader <amercadero@gmail.com>
Date: Fri, 14 Jun 2019 16:33:41 +0200
Subject: [PATCH 4/4] [#4842] Fix tests

---
 ckan/tests/controllers/test_util.py |  8 ++++----
 ckan/views/util.py                  | 12 +++++++-----
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/ckan/tests/controllers/test_util.py b/ckan/tests/controllers/test_util.py
index 09b22ae8f02..9e59ba9f2b2 100644
--- a/ckan/tests/controllers/test_util.py
+++ b/ckan/tests/controllers/test_util.py
@@ -11,7 +11,7 @@ class TestUtil(helpers.FunctionalTestBase):
     def test_redirect_ok(self):
         app = self._get_test_app()
         response = app.get(
-            url=url_for(controller='util', action='redirect'),
+            url=url_for('util.internal_redirect'),
             params={'url': '/dataset'},
             status=302,
         )
@@ -21,7 +21,7 @@ def test_redirect_ok(self):
     def test_redirect_external(self):
         app = self._get_test_app()
         response = app.get(
-            url=url_for(controller='util', action='redirect'),
+            url=url_for('util.internal_redirect'),
             params={'url': 'http://nastysite.com'},
             status=403,
         )
@@ -29,7 +29,7 @@ def test_redirect_external(self):
     def test_redirect_no_params(self):
         app = self._get_test_app()
         response = app.get(
-            url=url_for(controller='util', action='redirect'),
+            url=url_for('util.internal_redirect'),
             params={},
             status=400,
         )
@@ -37,7 +37,7 @@ def test_redirect_no_params(self):
     def test_redirect_no_params_2(self):
         app = self._get_test_app()
         response = app.get(
-            url=url_for(controller='util', action='redirect'),
+            url=url_for('util.internal_redirect'),
             params={'url': ''},
             status=400,
         )
diff --git a/ckan/views/util.py b/ckan/views/util.py
index 12001f9e570..254dd895ef7 100644
--- a/ckan/views/util.py
+++ b/ckan/views/util.py
@@ -11,17 +11,19 @@
 
 util = Blueprint(u'util', __name__)
 
+
 def internal_redirect():
-    ''' redirect to the url parameter. '''
+    u''' Redirect to the url parameter.
+    Only internal URLs are allowed'''
 
-    url = request.form.get('url')
+    url = request.form.get(u'url') or request.args.get(u'url')
     if not url:
-        base.abort(400, _('Missing Value') + ': url')
+        base.abort(400, _(u'Missing Value') + u': url')
 
     if h.url_is_local(url):
         return h.redirect_to(url)
     else:
-        base.abort(403, _('Redirecting to external site is not allowed.'))
+        base.abort(403, _(u'Redirecting to external site is not allowed.'))
 
 
 def primer():
@@ -32,5 +34,5 @@ def primer():
 
 
 util.add_url_rule(
-    u'/util/redirect', view_func=internal_redirect, methods=(u'POST',))
+    u'/util/redirect', view_func=internal_redirect, methods=(u'GET', u'POST',))
 util.add_url_rule(u'/testing/primer', view_func=primer)