Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix py/url-redirection by replacing request.referrer by get_redirect() #34237

Merged
merged 3 commits into from
Sep 22, 2023

Conversation

hussein-awala
Copy link
Member

redirect(location=request.referrer) is not safe, and we don't use it in the webserver, instead we use BaseView.get_redirect() to get the original the previous url.

Is there any specific reason to use request.referrer in #33932? (I don't think so)


^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in newsfragments.

@uranusjr
Copy link
Member

Does this also need to call update_redirect?

@potiuk
Copy link
Member

potiuk commented Sep 11, 2023

Does this also need to call update_redirect?

Yep. I thinl it should, otherwise back/resubmit button wil skip over it.

@pierrejeambrun pierrejeambrun merged commit c620e46 into apache:main Sep 22, 2023
43 checks passed
@pierrejeambrun
Copy link
Member

pierrejeambrun commented Sep 22, 2023

Changed milestone to 2.7.2, this is security related and can be released as bugfix I believe asap.

@pierrejeambrun pierrejeambrun added the type:bug-fix Changelog: Bug Fixes label Sep 22, 2023
@hussein-awala
Copy link
Member Author

I used the same milestone as #33932 because the change is not released yet. But it looks like the other PR is a bug-fix too.

@pierrejeambrun
Copy link
Member

pierrejeambrun commented Sep 23, 2023

Oh I see, I believe 33932 started as a bug fix but ended up adding new options and is now more of an ‘improvement’.

Putting back 2.8.0, sorry.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area:webserver Webserver related Issues type:bug-fix Changelog: Bug Fixes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants