Opened 4 years ago

Closed 6 months ago

#24336 closed Cleanup/optimization (fixed)

static server should skip for protocol-relative STATIC_URL

Reported by: Vlada Macek Owned by: farrepa
Component: Core (Other) Version: master
Severity: Normal Keywords:
Cc: Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no


As per and the spread of http/https websites it appears to be legitimate to have STATIC_URL and MEDIA_URL starting with // leading to a different domain under my control, but keeping the protocol. Hence this check

    # No-op if not in debug mode or an non-local prefix
    if not settings.DEBUG or (prefix and '://' in prefix):
        return []

in django.conf.urls.static.static will not match and does not turn off the static server as it should.

I guess :// should at least be changed to //.

Change History (8)

comment:1 Changed 4 years ago by Paul Hallett

Needs tests: set

comment:2 Changed 4 years ago by Paul Hallett

I experimented on a local branch of Django and changed the :// to // and didn't see any immediate problems. However this'll definitely need tests to verify.

comment:3 Changed 4 years ago by Aymeric Augustin

It would be safer to skip URLs starting with:

  • http://
  • https://
  • //

The most robust solution may be to parse the URL and skip it if the host part isn't empty.

comment:4 Changed 4 years ago by Tim Graham

Easy pickings: unset
Needs tests: unset
Triage Stage: UnreviewedAccepted
Type: BugCleanup/optimization

comment:5 Changed 4 years ago by farrepa

Owner: changed from nobody to farrepa
Status: newassigned

comment:6 Changed 6 months ago by Claude Paroz

Has patch: set

comment:7 Changed 6 months ago by Tim Graham

Triage Stage: AcceptedReady for checkin

comment:8 Changed 6 months ago by Claude Paroz <claude@…>

Resolution: fixed
Status: assignedclosed

In 2a74ceb5:

Fixed #24336 -- Made django.conf.urls.static() ignore all absolute URLs

Note: See TracTickets for help on using tickets.
Back to Top