mirror of
https://github.com/django/django.git
synced 2024-12-23 01:25:58 +00:00
Fixed #33648 -- Prevented extra redirect in LogoutView on invalid next page when LOGOUT_REDIRECT_URL is set.
This commit is contained in:
parent
fe7cb34544
commit
5591a72571
@ -175,7 +175,10 @@ class LogoutView(SuccessURLAllowedHostsMixin, TemplateView):
|
||||
# Security check -- Ensure the user-originating redirection URL is
|
||||
# safe.
|
||||
if not url_is_safe:
|
||||
next_page = self.request.path
|
||||
if settings.LOGOUT_REDIRECT_URL:
|
||||
next_page = resolve_url(settings.LOGOUT_REDIRECT_URL)
|
||||
else:
|
||||
next_page = self.request.path
|
||||
return next_page
|
||||
|
||||
def get_context_data(self, **kwargs):
|
||||
|
@ -1335,6 +1335,12 @@ class LogoutTest(AuthViewsTestCase):
|
||||
response = self.client.post("/logout/")
|
||||
self.assertRedirects(response, "/custom/", fetch_redirect_response=False)
|
||||
|
||||
@override_settings(LOGOUT_REDIRECT_URL="/custom/")
|
||||
def test_logout_redirect_url_setting_allowed_hosts_unsafe_host(self):
|
||||
self.login()
|
||||
response = self.client.post("/logout/allowed_hosts/?next=https://evil/")
|
||||
self.assertRedirects(response, "/custom/", fetch_redirect_response=False)
|
||||
|
||||
@override_settings(LOGOUT_REDIRECT_URL="logout")
|
||||
def test_logout_redirect_url_named_setting(self):
|
||||
self.login()
|
||||
|
Loading…
Reference in New Issue
Block a user