Merge ea91bed into 3e81e2e

jupyterhub · Jul 7, 2015 · 3711995 · 3711995
2 parents 3e81e2e + ea91bed
commit 3711995
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/jupyterhub/handlers/login.py b/jupyterhub/handlers/login.py
@@ -31,7 +31,10 @@ def _render(self, login_error=None, username=None):
         )
 
     def get(self):
-        next_url = self.get_argument('next', False)
+        next_url = self.get_argument('next', '')
+        if not next_url.startswith('/'):
+            # disallow non-absolute next URLs (e.g. full URLs)
+            next_url = ''
         user = self.get_current_user()
         if user:
             if not next_url:
@@ -65,7 +68,10 @@ def post(self):
             if not already_running:
                 yield self.spawn_single_user(user)
             self.set_login_cookie(user)
-            next_url = self.get_argument('next', default='') or self.hub.server.base_url
+            next_url = self.get_argument('next', default='')
+            if not next_url.startswith('/'):
+                next_url = ''
+            next_url = next_url or self.hub.server.base_url
             self.redirect(next_url)
             self.log.info("User logged in: %s", username)
         else: