Skip to content
This repository

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse code

Fix open redirect in Horizon.

LP 1039077. Disallow login redirects to anywhere other than the same origin.

Change-Id: I36e8e4f30cf440ecc73534af38fcd8d2a111a603
  • Loading branch information...
commit 35eada8a27323c0f83c400177797927aba6bc99b 1 parent 648b078
Paul McMillan authored August 22, 2012 russellb committed August 30, 2012

Showing 1 changed file with 8 additions and 1 deletion. Show diff stats Hide diff stats

  1. 9  horizon/views/auth_forms.py
9  horizon/views/auth_forms.py
@@ -28,6 +28,7 @@
28 28
 from django.conf import settings
29 29
 from django.contrib import messages
30 30
 from django.contrib.auth import REDIRECT_FIELD_NAME
  31
+from django.utils.http import same_origin
31 32
 from django.utils.translation import ugettext as _
32 33
 from keystoneclient import exceptions as keystone_exceptions
33 34
 
@@ -94,7 +95,13 @@ def handle(self, request, data):
94 95
         request.session['region_endpoint'] = endpoint
95 96
         request.session['region_name'] = region_name
96 97
 
97  
-        redirect_to = request.REQUEST.get(REDIRECT_FIELD_NAME, "")
  98
+        redirect_to = request.REQUEST.get(REDIRECT_FIELD_NAME, None)
  99
+        # Make sure the requested redirect matches the protocol,
  100
+        # domain, and port of this request
  101
+        if redirect_to and not same_origin(
  102
+                request.build_absolute_uri(redirect_to),
  103
+                request.build_absolute_uri()):
  104
+            redirect_to = None
98 105
 
99 106
         if data.get('tenant', None):
100 107
             try:

Git Notes

review

Verified+2: Jenkins
Approved+1: Mark McLoughlin <markmc@redhat.com>
Code-Review+2: Mark McLoughlin <markmc@redhat.com>
Submitted-by: Jenkins
Submitted-at: Thu, 30 Aug 2012 14:41:28 +0000
Reviewed-on: https://review.openstack.org/12193
Project: openstack/horizon
Branch: refs/heads/stable/essex

0 notes on commit 35eada8

Please sign in to comment.
Something went wrong with that request. Please try again.