simple-login/app
1
1
Fork 0
mirror of https://github.com/simple-login/app.git synced 2025-02-23 23:34:05 +08:00
Code Issues Projects Releases Packages Wiki Activity

Sanitize unused next parameter (#2040)

Browse source
This commit is contained in:
Adrià Casajús 2024-02-26 19:23:03 +01:00 committed by GitHub
parent 5959d40a00
commit 673e19b287
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/auth/views/google.py
View file

@ -7,7 +7,7 @@ from app.config import URL, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
from app.db import Session
from app.log import LOG
from app.models import User, File, SocialAuth
from app.utils import random_string, sanitize_email
from app.utils import random_string, sanitize_email, sanitize_next_url
from .login_utils import after_login
_authorization_base_url = "https://accounts.google.com/o/oauth2/v2/auth"
@ -29,7 +29,7 @@ def google_login():
# to avoid flask-login displaying the login error message
session.pop("_flashes", None)
next_url = request.args.get("next")
next_url = sanitize_next_url(request.args.get("next"))
# Google does not allow to append param to redirect_url
# we need to pass the next url by session