From 0a95f90012530bfe458b0dfa94f80b5706835759 Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Fri, 7 Oct 2022 09:42:25 +0200 Subject: [PATCH] OIDC RP: Use a separator value in state that is less likely to get lost in transit --- src/pretix/presale/views/customer.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/pretix/presale/views/customer.py b/src/pretix/presale/views/customer.py index ae70ed6d3..1d278ee69 100644 --- a/src/pretix/presale/views/customer.py +++ b/src/pretix/presale/views/customer.py @@ -20,6 +20,7 @@ # . # import hashlib +import re from importlib import import_module from urllib.parse import ( parse_qs, quote, urlencode, urljoin, urlparse, urlsplit, urlunparse, @@ -619,7 +620,7 @@ class SSOLoginView(RedirectBackMixin, View): }) if self.provider.method == "oidc": - return redirect(oidc_authorize_url(self.provider, f'{nonce}#{next_url}', redirect_uri)) + return redirect(oidc_authorize_url(self.provider, f'{nonce}§{next_url}', redirect_uri)) else: raise Http404("Unknown SSO method.") @@ -678,7 +679,7 @@ class SSOLoginReturnView(RedirectBackMixin, View): popup_origin, ) - nonce, redirect_to = request.GET['state'].split('#') + nonce, redirect_to = re.split("[#§]", request.GET['state']) # Allow # for backwards-compatibility for a while if nonce != request.session.get(f'pretix_customerauth_{self.provider.pk}_nonce'): return self._fail(