Mercurial > p > roundup > code
diff doc/upgrading.txt @ 5161:12190efa30d4
I realized that the __came_from and __redirect_to url parameters I
added to handle issues with the LoginAction and NewItemAction could
be used for XSS or other purposes.
So I check them using a new clean_url(url) function. This tries to
validate that the url is under the tracker's base url and that the
components of the url are properly url encoded. If it thinks something
is wrong with the url, it will raise a ValueError. I decided to not
attempt to fix the url's if there is an issue, better to bring it to the
tracker admin's attention.
Changed the code paths in NewItemAction and LoginAction that deal with
the form parameters to use the clean_url function on the form input
first.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Sat, 23 Jul 2016 14:00:49 -0400 |
| parents | 63294ed25e84 |
| children | e8b3d3a14563 |
line wrap: on
line diff
--- a/doc/upgrading.txt Fri Jul 22 20:59:44 2016 -0400 +++ b/doc/upgrading.txt Sat Jul 23 14:00:49 2016 -0400 @@ -130,7 +130,10 @@ The login form has been improved to work with some back end code changes. Now when a user logs in they stay on the same page where they started the login. To make this work, you must change the tal that is -used to set the ``__came_from`` form variable. +used to set the ``__came_from`` form variable. Note that the url +assigned to __came_from must be url encoded/quoted and be under the +tracker's base url. If the base_url uses http, you can set the url to +https. Replace the existing code in the tracker's html/page.html page that looks similar to (look for name="__came_from"):: @@ -200,7 +203,9 @@ property. It is a url which can be used when creating any new item (issue, user, keyword ....). It controls the next page displayed after creating the item. If '__redirect_to' is not set, then you end up on -the page for the newly created item. +the page for the newly created item. The url value assigned to +__redirect_to must be under the tracker's base url and must be properly +url encoded. html/_generic.404.html in trackers use page template ----------------------------------------------------