|
6 | 6 | from django.contrib.admin.views.decorators import staff_member_required |
7 | 7 | from django.http import HttpResponse, HttpRequest, HttpResponseNotFound, JsonResponse |
8 | 8 | from django.shortcuts import render, redirect |
9 | | -from django.urls import reverse |
| 9 | +from django.urls import reverse, resolve |
10 | 10 | from django.utils.http import url_has_allowed_host_and_scheme |
11 | 11 | from django.views.decorators.cache import never_cache |
12 | 12 |
|
@@ -105,10 +105,7 @@ def clear_queue_registry(request: HttpRequest, queue_name: str, registry_name: s |
105 | 105 | registry = queue.get_registry(registry_name) |
106 | 106 | if registry is None: |
107 | 107 | return HttpResponseNotFound() |
108 | | - |
109 | | - next_url = request.META.get("HTTP_REFERER") or reverse("queue_registry_jobs", args=[queue_name, registry_name]) |
110 | | - if not url_has_allowed_host_and_scheme(next_url, allowed_hosts=None): |
111 | | - messages.warning(request, "Bad followup URL") |
| 108 | + next_url = _check_next_url(request, reverse("queue_registry_jobs", args=[queue_name, registry_name])) |
112 | 109 | if request.method == "POST": |
113 | 110 | try: |
114 | 111 | if registry is queue: |
@@ -204,15 +201,23 @@ def queue_confirm_action(request: HttpRequest, queue_name: str) -> HttpResponse: |
204 | 201 | return redirect(next_url) |
205 | 202 |
|
206 | 203 |
|
| 204 | +def _check_next_url(request: HttpRequest, default_next_url: str) -> str: |
| 205 | + next_url = request.POST.get("next_url", default_next_url) |
| 206 | + if not url_has_allowed_host_and_scheme(next_url, allowed_hosts=None): |
| 207 | + messages.warning(request, "Bad followup URL") |
| 208 | + try: |
| 209 | + resolve(next_url) |
| 210 | + except Exception: |
| 211 | + messages.warning(request, "Bad followup URL") |
| 212 | + next_url = default_next_url |
| 213 | + return next_url |
| 214 | + |
| 215 | + |
207 | 216 | @never_cache |
208 | 217 | @staff_member_required |
209 | 218 | def queue_actions(request: HttpRequest, queue_name: str) -> HttpResponse: |
210 | 219 | queue = get_queue(queue_name) |
211 | | - next_url = request.POST.get("next_url") or reverse("queue_registry_jobs", args=[queue_name, "queued"]) |
212 | | - if not url_has_allowed_host_and_scheme(next_url, allowed_hosts=None): |
213 | | - messages.warning(request, "Bad followup URL") |
214 | | - next_url = reverse("queue_registry_jobs", args=[queue_name, "queued"]) |
215 | | - |
| 220 | + next_url = _check_next_url(request, reverse("queue_registry_jobs", args=[queue_name, "queued"])) |
216 | 221 | action = request.POST.get("action", False) |
217 | 222 | job_names = request.POST.get("job_names", False) |
218 | 223 | if request.method != "POST" or not action or not job_names: |
|
0 commit comments