Allow script name URLs in the next URL of the login page.

refs #5343
This commit is contained in:
Aditya Toshniwal 2022-09-20 14:44:05 +05:30 committed by Akshay Joshi
parent 2b00480605
commit 4d9dfe7d04

View File

@ -838,8 +838,12 @@ def get_safe_post_login_redirect():
allow_list = [
url_for('browser.index')
]
url = get_post_login_redirect()
if url in allow_list:
return url
if "SCRIPT_NAME" in os.environ and os.environ["SCRIPT_NAME"]:
allow_list.append(os.environ["SCRIPT_NAME"])
return "/"
url = get_post_login_redirect()
for item in allow_list:
if url.startswith(item):
return url
return os.environ.get("SCRIPT_NAME", "/")