Changeset - ad131f703996
[Not reviewed]
stable
0 1 0
Mads Kiilerich - 10 years ago 2015-09-20 22:22:50
madski@unity3d.com
login: make it clear that an invalid came_from is an invalid request
1 file changed with 4 insertions and 1 deletions:
0 comments (0 inline, 0 general)
kallithea/controllers/login.py
Show inline comments
 
@@ -73,13 +73,16 @@ class LoginController(BaseController):
 
                      'is: %s' % (parsed.netloc, parsed, server_parsed))
 
            return False
 
        return True
 

	
 
    def index(self):
 
        c.came_from = safe_str(request.GET.pop('came_from', ''))
 
        if self._validate_came_from(c.came_from):
 
        if c.came_from:
 
            if not self._validate_came_from(c.came_from):
 
                log.error('Invalid came_from (not server-relative): %r', c.came_from)
 
                raise HTTPBadRequest()
 
            came_from = url(c.came_from, **request.GET)
 
        else:
 
            c.came_from = came_from = url('home')
 

	
 
        not_default = self.authuser.username != User.DEFAULT_USER
 
        ip_allowed = AuthUser.check_ip_allowed(self.authuser, self.ip_addr)
0 comments (0 inline, 0 general)