Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixed #18161 - Redirection url determination in the admin login with same logic as in the login view #131

Closed
wants to merge 1 commit into from
Closed

Fixed #18161 - Redirection url determination in the admin login with same logic as in the login view #131

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 12 additions & 1 deletion django/contrib/admin/sites.py
View file
Open in desktop
@@ -1,3 +1,4 @@
import urlparse
from functools import update_wrapper from functools import update_wrapper
from django.http import Http404, HttpResponseRedirect from django.http import Http404, HttpResponseRedirect
from django.contrib.admin import ModelAdmin, actions from django.contrib.admin import ModelAdmin, actions
Expand Down Expand Up @@ -311,10 +312,19 @@ def login(self, request, extra_context=None):
Displays the login form for the given HttpRequest. Displays the login form for the given HttpRequest.
""" """
from django.contrib.auth.views import login from django.contrib.auth.views import login
redirect_to = request.REQUEST.get(REDIRECT_FIELD_NAME, '')
if redirect_to:
netloc = urlparse.urlparse(redirect_to)[1]
# Heavier security check -- don't allow redirection to a different
# host
if netloc and netloc != request.get_host():
redirect_to = ''
if not redirect_to:
redirect_to = request.get_full_path()
context = { context = {
'title': _('Log in'), 'title': _('Log in'),
'app_path': request.get_full_path(), 'app_path': request.get_full_path(),
REDIRECT_FIELD_NAME: request.get_full_path(), REDIRECT_FIELD_NAME: redirect_to,
} }
context.update(extra_context or {}) context.update(extra_context or {})
defaults = { defaults = {
Expand All @@ -323,6 +333,7 @@ def login(self, request, extra_context=None):
'authentication_form': self.login_form or AdminAuthenticationForm, 'authentication_form': self.login_form or AdminAuthenticationForm,
'template_name': self.login_template or 'admin/login.html', 'template_name': self.login_template or 'admin/login.html',
} }
print defaults
return login(request, **defaults) return login(request, **defaults)


@never_cache @never_cache
Expand Down