#23602 closed Uncategorized (fixed)
Document that get_absolute_url should not return a link/url made from user input
| Reported by: | Markus Holtermann | Owned by: | Markus Holtermann |
|---|---|---|---|
| Component: | Documentation | Version: | dev |
| Severity: | Normal | Keywords: | |
| Cc: | Markus Holtermann | Triage Stage: | Accepted |
| Has patch: | yes | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | no | UI/UX: | no |
Description
The docs for get_absolute_url() should clearly state that returning something completely made from user input is a bad idea and may lead to link or redirect poisoning.
https://docs.djangoproject.com/en/1.7/ref/models/instances/#get-absolute-url
Change History (7)
comment:1 Changed 9 years ago by
| Has patch: | set |
|---|---|
| Status: | new → assigned |
comment:3 Changed 9 years ago by
| Summary: | Document that get_absolute_url should return a link/url made from user input → Document that get_absolute_url should not return a link/url made from user input |
|---|
Oops, missed a "not" in the subject.
comment:4 Changed 9 years ago by
| Triage Stage: | Unreviewed → Accepted |
|---|
comment:5 Changed 9 years ago by
| Resolution: | → fixed |
|---|---|
| Status: | assigned → closed |
Note: See
TracTickets for help on using
tickets.
Pull request: https://github.com/django/django/pull/3307