CGM_Public/pretix_original
2
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-08 10:27:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

RejectInvalidInputMiddleware: Ignore invalid charsets on body

Browse Source
This commit is contained in:
Raphael Michel
2026-06-25 17:42:42 +02:00
parent a8997f8971
commit 9ebd5d83ca
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pretix/base/middleware.py
+10 -2
View File
@@ -370,8 +370,16 @@ class RejectInvalidInputMiddleware(MiddlewareMixin):
if "\x00" in request.META['QUERY_STRING'] or "%00" in request.META['QUERY_STRING']:
raise BadRequest("Invalid characters in input.")
if request.method in ('POST', 'PUT', 'PATCH') and request.content_type == "application/x-www-form-urlencoded":
if any("\x00" in value for key, value_list in request.POST.lists() for value in value_list):
raise BadRequest("Invalid characters in input.")
try:
post_data = request.POST.lists()
except BadRequest:
# Reading request.POST wasn't possible, probably an invalid charset. Django will crash once we actually
# use request.POST, but if we don't, let's not crash it (required for some weird payment provider
# webhooks, e.g. computop).
pass
else:
if any("\x00" in value for key, value_list in post_data for value in value_list):
raise BadRequest("Invalid characters in input.")
class CustomCommonMiddleware(CommonMiddleware):