Fix success_url parameter issue for Edit Snapshot
The "success_url" param is used when updating the project snapshot
[1] and it lacks sanitizing the input URL that allows an attacker to
redirect the user to another website. This patch update 'Updateview'
class to not use the "sucess_url" method.
Closes-bug:
[1]
from django.urls import reverse
from django.urls import reverse_lazy
-from django.utils.http import urlencode
from django.utils.translation import gettext_lazy as _
from horizon import exceptions
@@ -104,11 +103,8 @@ class UpdateView(forms.ModalFormView):
def get_context_data(self, **kwargs):
context = super().get_context_data(**kwargs)
context['snapshot'] = self.get_object()
- success_url = self.request.GET.get('success_url', "")
args = (self.kwargs['snapshot_id'],)
- params = urlencode({"success_url": success_url})
- context['submit_url'] = "?".join([reverse(self.submit_url, args=args),
- params])
+ context['submit_url'] = reverse(self.submit_url, args=args)
return context
def get_initial(self):
@@ -117,12 +113,6 @@ class UpdateView(forms.ModalFormView):
'name': snapshot.name,
'description': snapshot.description}
- def get_success_url(self):
- success_url = self.request.GET.get(
- "success_url",
- reverse_lazy("horizon:project:snapshots:index"))
- return success_url
-
class DetailView(tabs.TabView):
tab_group_class = vol_snapshot_tabs.SnapshotDetailTabs
