Ticket #18856: 18856-1.diff

File 18856-1.diff, 2.2 KB (added by claudep, 2 years ago)

Check REFERER before redirection

  • django/views/i18n.py

    diff --git a/django/views/i18n.py b/django/views/i18n.py
    index 00ef224..26022fa 100644
    a b  
    11import os
     2import re
    23import gettext as gettext_module
    34
    45from django import http
    def set_language(request): 
    2425    next = request.REQUEST.get('next', None)
    2526    if not next:
    2627        next = request.META.get('HTTP_REFERER', None)
     28        if next and not re.match("^https?://%s/" % re.escape(request.get_host()), next):
     29            next = None
    2730    if not next:
    2831        next = '/'
    2932    response = http.HttpResponseRedirect(next)
  • tests/regressiontests/views/tests/i18n.py

    diff --git a/tests/regressiontests/views/tests/i18n.py b/tests/regressiontests/views/tests/i18n.py
    index 601df6d..b3014dd 100644
    a b class I18NTests(TestCase): 
    2525            self.assertRedirects(response, 'http://testserver/views/')
    2626            self.assertEqual(self.client.session['django_language'], lang_code)
    2727
     28    def test_setlang_nonext(self):
     29        """Test setlang redirection when next variable is not set"""
     30        response = self.client.post('/views/i18n/setlang/', {'language': 'fr'})
     31        self.assertRedirects(response, 'http://testserver/')
     32
     33        response = self.client.post('/views/i18n/setlang/', {'language': 'fr'},
     34            HTTP_REFERER='http://testserver/views/')
     35        self.assertRedirects(response, 'http://testserver/views/')
     36
     37        response = self.client.post('/views/i18n/setlang/', {'language': 'fr'},
     38            HTTP_REFERER='https://www.evil.org/')
     39        self.assertRedirects(response, 'http://testserver/')
     40
    2841    def test_setlang_reversal(self):
    2942        self.assertEqual(reverse('set_language'), '/views/i18n/setlang/')
    3043
  • tests/urls.py

    diff --git a/tests/urls.py b/tests/urls.py
    index 4f37ab5..b76fd8c 100644
    a b  
    11from django.conf.urls import patterns, include
    22
    33urlpatterns = patterns('',
     4    (r'^$', 'regressiontests.views.views.index_page'),
     5
    46    # test_client modeltest urls
    57    (r'^test_client/', include('modeltests.test_client.urls')),
    68    (r'^test_client_regress/', include('regressiontests.test_client_regress.urls')),
Back to Top