mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
940545c2c4
The user edit page redirected to its ?next= parameter after saving, whatever it held: a link to the edit page with next=https://other.site sent the administrator who saved the form to that site (CodeQL py/url-redirection). The account page links there with a next of this site. next is now followed only when url_has_allowed_host_and_scheme accepts it for this host, as user_instance_delete already does; otherwise the user list. The test fails on the previous code for an absolute URL, a scheme-relative one and a backslash variant. |
||
|---|---|---|
| .. | ||
| migrations | ||
| templates/admin | ||
| __init__.py | ||
| apps.py | ||
| decorators.py | ||
| forms.py | ||
| models.py | ||
| permissions.py | ||
| test_user_create.py | ||
| test_user_update_next.py | ||
| tests.py | ||
| urls.py | ||
| views.py | ||