From 09f0fd6122324fe64a5ab69a017d69ebb32b6ec5 Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Sun, 16 Jul 2017 20:12:43 +0200 Subject: [PATCH] Fixed wrong field value. fix #1180 --- modoboa/core/views/auth.py | 5 +++-- modoboa/core/views/base.py | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/modoboa/core/views/auth.py b/modoboa/core/views/auth.py index d8e87f96a..2ca28c56a 100644 --- a/modoboa/core/views/auth.py +++ b/modoboa/core/views/auth.py @@ -57,11 +57,11 @@ def dologin(request): "user": form.cleaned_data["username"]} ) - nextlocation = request.POST.get("next", None) + nextlocation = request.POST.get("next", "") httpcode = 401 else: form = forms.LoginForm() - nextlocation = request.GET.get("next", None) + nextlocation = request.GET.get("next", "") httpcode = 200 announcements = signals.get_announcements.send( @@ -75,6 +75,7 @@ def dologin(request): request), status=httpcode) + dologin = never_cache(dologin) diff --git a/modoboa/core/views/base.py b/modoboa/core/views/base.py index 69b798179..8d4634bf3 100644 --- a/modoboa/core/views/base.py +++ b/modoboa/core/views/base.py @@ -18,7 +18,7 @@ def find_nextlocation(request, user): return reverse("core:user_index") nextlocation = request.POST.get("next", request.GET.get("next")) condition = ( - nextlocation is not None and nextlocation != "" and nextlocation != "None" and + nextlocation and is_safe_url(nextlocation, host=request.get_host()) ) if condition: