Commit 3c45fb85 authored by Baptiste Mispelon's avatar Baptiste Mispelon Committed by Tim Graham
Browse files

Fixed #10491 -- Allowed passing lazy objects to HttpResponseRedirect. 

Thanks liangent for the report.
parent 75cf5fc7

django/http/response.py

+2 −2
Original line number Diff line number Diff line
@@ -14,7 +14,7 @@ from django.core import signing 
from django.core.exceptions import DisallowedRedirect

from django.http.cookie import SimpleCookie

from django.utils import six, timezone

from django.utils.encoding import force_bytes, iri_to_uri

from django.utils.encoding import force_bytes, force_text, iri_to_uri

from django.utils.http import cookie_date

from django.utils.six.moves import map
@@ -393,7 +393,7 @@ class HttpResponseRedirectBase(HttpResponse): 
    allowed_schemes = ['http', 'https', 'ftp']



    def __init__(self, redirect_to, *args, **kwargs):

        parsed = urlparse(redirect_to)

        parsed = urlparse(force_text(redirect_to))

        if parsed.scheme and parsed.scheme not in self.allowed_schemes:

            raise DisallowedRedirect("Unsafe redirect to URL with protocol '%s'" % parsed.scheme)

        super(HttpResponseRedirectBase, self).__init__(*args, **kwargs)

tests/httpwrappers/tests.py

+13 −1
Original line number Diff line number Diff line
@@ -16,10 +16,13 @@ from django.http import (QueryDict, HttpResponse, HttpResponseRedirect, 
                         SimpleCookie, BadHeaderError,

                         parse_cookie)

from django.test import TestCase

from django.utils.encoding import smart_str

from django.utils.encoding import smart_str, force_text

from django.utils.functional import lazy

from django.utils._os import upath

from django.utils import six



lazystr = lazy(force_text, six.text_type)





class QueryDictTests(unittest.TestCase):

    def test_missing_key(self):
@@ -366,6 +369,10 @@ class HttpResponseTests(unittest.TestCase): 
        self.assertEqual(list(i), [b'abc'])

        self.assertEqual(list(i), [])



    def test_lazy_content(self):

        r = HttpResponse(lazystr('helloworld'))

        self.assertEqual(r.content, b'helloworld')



    def test_file_interface(self):

        r = HttpResponse()

        r.write(b"hello")
@@ -402,6 +409,11 @@ class HttpResponseSubclassesTests(TestCase): 
        # Test that url attribute is right

        self.assertEqual(response.url, response['Location'])



    def test_redirect_lazy(self):

        """Make sure HttpResponseRedirect works with lazy strings."""

        r = HttpResponseRedirect(lazystr('/redirected/'))

        self.assertEqual(r.url, '/redirected/')



    def test_not_modified(self):

        response = HttpResponseNotModified()

        self.assertEqual(response.status_code, 304)