diff --git a/cps/redirect.py b/cps/redirect.py old mode 100644 new mode 100755 index 09b3101f..337bb77b --- a/cps/redirect.py +++ b/cps/redirect.py @@ -29,7 +29,7 @@ from urllib.parse import urlparse, urljoin -from flask import request, url_for, redirect +from flask import request, url_for, redirect, current_app def is_safe_url(target): @@ -38,16 +38,15 @@ def is_safe_url(target): return test_url.scheme in ('http', 'https') and ref_url.netloc == test_url.netloc -def get_redirect_target(): - for target in request.values.get('next'), request.referrer: - if not target: - continue - if is_safe_url(target): - return target +def remove_prefix(text, prefix): + if text.startswith(prefix): + return text[len(prefix):] + return "" def redirect_back(endpoint, **values): - target = request.form['next'] - if not target or not is_safe_url(target): + target = request.form.get('next', None) or url_for(endpoint, **values) + adapter = current_app.url_map.bind(urlparse(request.host_url).netloc) + if not len(adapter.allowed_methods(remove_prefix(target, request.environ.get('HTTP_X_SCRIPT_NAME',"")))): target = url_for(endpoint, **values) return redirect(target) diff --git a/cps/web.py b/cps/web.py index 705627e7..4a95a21d 100644 --- a/cps/web.py +++ b/cps/web.py @@ -1322,7 +1322,7 @@ def handle_login_user(user, remember, message, category): ub.store_user_session() flash(message, category=category) [limiter.limiter.storage.clear(k.key) for k in limiter.current_limits] - return redirect_back(url_for("web.index")) + return redirect_back("web.index") def render_login(username="", password=""): diff --git a/test/Calibre-Web TestSummary_Linux.html b/test/Calibre-Web TestSummary_Linux.html index 031ba52c..49fa93ef 100644 --- a/test/Calibre-Web TestSummary_Linux.html +++ b/test/Calibre-Web TestSummary_Linux.html @@ -37,20 +37,20 @@
-

Start Time: 2024-02-10 19:51:08

+

Start Time: 2024-02-11 21:14:02

-

Stop Time: 2024-02-11 02:37:31

+

Stop Time: 2024-02-12 04:05:52

-

Duration: 5h 36 min

+

Duration: 5h 42 min

@@ -234,12 +234,12 @@ - + TestBackupMetadata 21 - 16 + 20 + 1 0 - 5 0 Detail @@ -383,37 +383,26 @@ - +
TestBackupMetadata - test_backup_change_custom_date
- PASS - - - - - - -
TestBackupMetadata - test_backup_change_custom_float
-
- ERROR + FAIL
-