Opened 9 years ago

Closed 6 years ago

#24336 closed Cleanup/optimization (fixed)

static server should skip for protocol-relative STATIC_URL

Reported by: Vlada Macek Owned by: farrepa
Component: Core (Other) Version: dev
Severity: Normal Keywords:
Cc: Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

As per ​http://stackoverflow.com/questions/550038/is-it-valid-to-replace-http-with-in-a-script-src-http and the spread of http/https websites it appears to be legitimate to have STATIC_URL and MEDIA_URL starting with // leading to a different domain under my control, but keeping the protocol. Hence this check

    # No-op if not in debug mode or an non-local prefix
    if not settings.DEBUG or (prefix and '://' in prefix):
        return []

in django.conf.urls.static.static will not match and does not turn off the static server as it should.

I guess :// should at least be changed to //.

Change History (8)

comment:1 by Paul Hallett, 9 years ago

Needs tests: set

comment:2 by Paul Hallett, 9 years ago

I experimented on a local branch of Django and changed the :// to // and didn't see any immediate problems. However this'll definitely need tests to verify.

comment:3 by Aymeric Augustin, 9 years ago

It would be safer to skip URLs starting with:

  • http://
  • https://
  • //

The most robust solution may be to parse the URL and skip it if the host part isn't empty.

comment:4 by Tim Graham, 9 years ago

Easy pickings: unset
Needs tests: unset
Triage Stage: Unreviewed → Accepted
Type: Bug → Cleanup/optimization

comment:5 by farrepa, 9 years ago

Owner: changed from nobody to farrepa
Status: new → assigned

comment:6 by Claude Paroz, 6 years ago

Has patch: set

​PR

comment:7 by Tim Graham, 6 years ago

Triage Stage: Accepted → Ready for checkin

comment:8 by Claude Paroz <claude@…>, 6 years ago

Resolution: → fixed
Status: assigned → closed

In 2a74ceb5:

Fixed #24336 -- Made django.conf.urls.static() ignore all absolute URLs

Note: See TracTickets for help on using tickets.
Back to Top