Code

Ticket #18856: 18856-1.diff

File 18856-1.diff, 2.2 KB (added by claudep, 18 months ago)

Check REFERER before redirection

Line 
1diff --git a/django/views/i18n.py b/django/views/i18n.py
2index 00ef224..26022fa 100644
3--- a/django/views/i18n.py
4+++ b/django/views/i18n.py
5@@ -1,4 +1,5 @@
6 import os
7+import re
8 import gettext as gettext_module
9 
10 from django import http
11@@ -24,6 +25,8 @@ def set_language(request):
12     next = request.REQUEST.get('next', None)
13     if not next:
14         next = request.META.get('HTTP_REFERER', None)
15+        if next and not re.match("^https?://%s/" % re.escape(request.get_host()), next):
16+            next = None
17     if not next:
18         next = '/'
19     response = http.HttpResponseRedirect(next)
20diff --git a/tests/regressiontests/views/tests/i18n.py b/tests/regressiontests/views/tests/i18n.py
21index 601df6d..b3014dd 100644
22--- a/tests/regressiontests/views/tests/i18n.py
23+++ b/tests/regressiontests/views/tests/i18n.py
24@@ -25,6 +25,19 @@ class I18NTests(TestCase):
25             self.assertRedirects(response, 'http://testserver/views/')
26             self.assertEqual(self.client.session['django_language'], lang_code)
27 
28+    def test_setlang_nonext(self):
29+        """Test setlang redirection when next variable is not set"""
30+        response = self.client.post('/views/i18n/setlang/', {'language': 'fr'})
31+        self.assertRedirects(response, 'http://testserver/')
32+
33+        response = self.client.post('/views/i18n/setlang/', {'language': 'fr'},
34+            HTTP_REFERER='http://testserver/views/')
35+        self.assertRedirects(response, 'http://testserver/views/')
36+
37+        response = self.client.post('/views/i18n/setlang/', {'language': 'fr'},
38+            HTTP_REFERER='https://www.evil.org/')
39+        self.assertRedirects(response, 'http://testserver/')
40+
41     def test_setlang_reversal(self):
42         self.assertEqual(reverse('set_language'), '/views/i18n/setlang/')
43 
44diff --git a/tests/urls.py b/tests/urls.py
45index 4f37ab5..b76fd8c 100644
46--- a/tests/urls.py
47+++ b/tests/urls.py
48@@ -1,6 +1,8 @@
49 from django.conf.urls import patterns, include
50 
51 urlpatterns = patterns('',
52+    (r'^$', 'regressiontests.views.views.index_page'),
53+
54     # test_client modeltest urls
55     (r'^test_client/', include('modeltests.test_client.urls')),
56     (r'^test_client_regress/', include('regressiontests.test_client_regress.urls')),