CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

Don't use Django's redirect() for user-supplied paths

Browse Source
This commit is contained in:
Raphael Michel
2022-11-17 11:46:03 +01:00
parent f18fb02d0b
commit 7b58ddbfde
5 changed files with 23 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/pretix/presale/views/cart.py
View File

@@ -63,6 +63,7 @@ from pretix.base.services.cart import (
remove_cart_position,
)
from pretix.base.views.tasks import AsyncAction
from pretix.helpers.http import redirect_to_url
from pretix.multidomain.urlreverse import eventreverse
from pretix.presale.views import (
CartMixin, EventViewMixin, allow_cors_if_namespaced,
@@ -652,7 +653,7 @@ class RedeemView(NoSearchIndexViewMixin, EventViewMixin, CartMixin, TemplateView
if err:
messages.error(request, _(err))
return redirect(self.get_next_url() + "?voucher_invalid")
return redirect_to_url(self.get_next_url() + "?voucher_invalid")
return super().dispatch(request, *args, **kwargs)