PR#2504: Only redirect back to HTTP_REFERER if it points to kojiweb -

koji

#2504 Only redirect back to HTTP_REFERER if it points to kojiweb

Merged Oct 29, 2020 by tkopecek. Opened Sep 23, 2020 by alexi.

alexi/koji fix_2503 into master

alexi commented Sep 23, 2020

The HTTP_REFERER is used to send the user back to the same page where they were before they logged in or out. If the HTTP_REFERER does not point to this same server, it's no longer useful and may end up being harmful (as demonstrated by #2503). In that case, HTTP_REFERER should not be used and we should default to redirecting to index.

Fixes https://pagure.io/koji/issue/2503.

Metadata Update from @tkopecek:
- Pull-request tagged with: testing-ready

Oct 19, 2020

tkopecek commented Oct 22, 2020

:thumbsup:

Metadata Update from @tkopecek:
- Pull-request untagged with: testing-ready
- Pull-request tagged with: no_qe

Oct 29, 2020

tkopecek commented Oct 29, 2020

Commit a09cacc8 fixes this pull-request

Pull-Request has been merged by tkopecek

Oct 29, 2020