mirror of
https://gitlab.archlinux.org/archlinux/aurweb.git
synced 2025-02-03 10:43:03 +01:00
bugfix: relax next
verification
AUR renders its own 404 Not Found page when a bad route is encountered. Introducing the previous verification caused an error in this case when setting a language while viewing the Not Found page. So, instead of checking through routes, just make sure that the next parameter starts with a '/' character, which removes the possibility of any cross attacks. + Removed aurweb.asgi.routes; no longer needed. Signed-off-by: Kevin Morris <kevr@0cost.org>
This commit is contained in:
parent
32abdbafae
commit
822905be7d
3 changed files with 4 additions and 15 deletions
|
@ -61,7 +61,7 @@ def test_language_invalid_next():
|
|||
""" Test an invalid next route at '/language'. """
|
||||
post_data = {
|
||||
"set_lang": "de",
|
||||
"next": "/BLAHBLAHFAKE"
|
||||
"next": "https://evil.net"
|
||||
}
|
||||
with client as req:
|
||||
response = req.post("/language", data=post_data)
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue