This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/allura.git
commit 7013d3506ea793e738be2e3762b1376eef126fed Author: Dave Brondsema <[email protected]> AuthorDate: Tue May 5 17:21:04 2026 -0400 [#8603] use _verify_return_to in pwd_expired_change --- Allura/allura/controllers/auth.py | 4 ++-- Allura/allura/tests/functional/test_auth.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Allura/allura/controllers/auth.py b/Allura/allura/controllers/auth.py index 669117200..6b7272d87 100644 --- a/Allura/allura/controllers/auth.py +++ b/Allura/allura/controllers/auth.py @@ -388,7 +388,7 @@ def logout(self, return_to=None): redirect(config.get('auth.post_logout_url', '/')) @staticmethod - def _verify_return_to(return_to): + def _verify_return_to(return_to: str | None) -> str: # protect against any "open redirect" attacks using an external URL if not return_to or '\n' in return_to: return_to = '/' @@ -614,7 +614,7 @@ def pwd_expired(self, **kw): @validate(F.password_change_form, error_handler=pwd_expired) def pwd_expired_change(self, **kw): require_authenticated() - return_to = kw.get('return_to') + return_to = self._verify_return_to(kw.get('return_to')) ap = plugin.AuthenticationProvider.get(request) failure_redirect_url = tg.url('/auth/pwd_expired', dict(return_to=return_to)) diff --git a/Allura/allura/tests/functional/test_auth.py b/Allura/allura/tests/functional/test_auth.py index 5db3a7f36..3893a4bda 100644 --- a/Allura/allura/tests/functional/test_auth.py +++ b/Allura/allura/tests/functional/test_auth.py @@ -2870,7 +2870,7 @@ def test_change_pwd_validation(self): assert 'Passwords must match' in r r = self.check_validation('bad', 'qwerty', 'qwerty') assert 'Incorrect password' in self.webflash(r) - assert r.location == 'http://localhost/auth/pwd_expired?return_to=' + assert r.location == 'http://localhost/auth/pwd_expired?return_to=%2F' with h.push_config(config, **{'auth.min_password_len': 3}): r = self.check_validation('foo', 'foo', 'foo')
