From f2b8e9c089781e2ae607dfe10e77d7256dc40acc Mon Sep 17 00:00:00 2001 From: tobes Date: Wed, 26 Jun 2013 11:59:09 +0100 Subject: [PATCH] [#1039] make sure came_from url is sane (local) --- ckan/controllers/user.py | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/ckan/controllers/user.py b/ckan/controllers/user.py index 1665625b6c0..358bdfa8257 100644 --- a/ckan/controllers/user.py +++ b/ckan/controllers/user.py @@ -1,5 +1,6 @@ import logging from urllib import quote +from urlparse import urlparse from pylons import session, c, g, request, config from pylons.i18n import _ @@ -315,7 +316,7 @@ def login(self, error=None): def logged_in(self): # redirect if needed came_from = request.params.get('came_from', '') - if came_from: + if self._sane_came_from(came_from): return h.redirect_to(str(came_from)) if c.user: @@ -348,7 +349,7 @@ def logout(self): def logged_out(self): # redirect if needed came_from = request.params.get('came_from', '') - if came_from: + if self._sane_came_from(came_from): return h.redirect_to(str(came_from)) h.redirect_to(controller='user', action='logged_out_page') @@ -606,3 +607,11 @@ def unfollow(self, id): or e.error_dict) h.flash_error(error_message) h.redirect_to(controller='user', action='read', id=id) + + def _sane_came_from(self, url): + '''Returns True if came_from is local''' + return not bool(not url + # url has a scheme eg http:// + or urlparse(url).scheme + # url starts with // which can be none relative + or (len(url) >= 2 and url.startswith('//')))