mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 22:26:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #26308 -- Prevented crash with binary URLs in is_safe_url()

Browse Source 
This fixes a regression introduced by c5544d2892.
Thanks John Eskew for the reporti and Tim Graham for the review.
This commit is contained in:
Claude Paroz
2016-03-04 15:41:52 +01:00
parent cecbf1bdef
commit ada7a4aefb
4 changed files with 20 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
django/utils/http.py
View File

@@ -290,6 +290,8 @@ def is_safe_url(url, host=None):
url = url.strip()
if not url:
return False
if six.PY2:
url = force_text(url, errors='replace')
# Chrome treats \ completely as / in paths but it could be part of some
# basic auth credentials so we need to check both URLs.
return _is_safe_url(url, host) and _is_safe_url(url.replace('\\', '/'), host)