#23602 closed Uncategorized (fixed)
Document that get_absolute_url should not return a link/url made from user input
Reported by: | Markus Holtermann | Owned by: | Markus Holtermann |
---|---|---|---|
Component: | Documentation | Version: | dev |
Severity: | Normal | Keywords: | |
Cc: | Markus Holtermann | Triage Stage: | Accepted |
Has patch: | yes | Needs documentation: | no |
Needs tests: | no | Patch needs improvement: | no |
Easy pickings: | no | UI/UX: | no |
Description
The docs for get_absolute_url()
should clearly state that returning something completely made from user input is a bad idea and may lead to link or redirect poisoning.
https://docs.djangoproject.com/en/1.7/ref/models/instances/#get-absolute-url
Change History (7)
comment:1 Changed 9 years ago by
Has patch: | set |
---|---|
Status: | new → assigned |
comment:3 Changed 9 years ago by
Summary: | Document that get_absolute_url should return a link/url made from user input → Document that get_absolute_url should not return a link/url made from user input |
---|
Oops, missed a "not" in the subject.
comment:4 Changed 9 years ago by
Triage Stage: | Unreviewed → Accepted |
---|
comment:5 Changed 9 years ago by
Resolution: | → fixed |
---|---|
Status: | assigned → closed |
Note: See
TracTickets for help on using
tickets.
Pull request: https://github.com/django/django/pull/3307