Ticket #11457: 11457-5.patch

django/contrib/auth/views.py

@@ -15 +15 @@
 from django.contrib.auth.models import User
 from django.views.decorators.cache import never_cache
 
+
+
+
+
 @csrf_protect
 @never_cache
 def login(request, template_name='registration/login.html',
@@ -26 +30 @@
         form = authentication_form(data=request.POST)
         if form.is_valid():
             # Light security check -- make sure redirect_to isn't garbage.
-            if not redirect_to or '//' in redirect_to or ' ' in redirect_to:
+            if not redirect_to or ' ' in redirect_to:
                 redirect_to = settings.LOGIN_REDIRECT_URL
+
+
+
+
+
+
+
             from django.contrib.auth import login
             login(request, form.get_user())
             if request.session.test_cookie_worked():

django/contrib/auth/tests/views.py

@@ -1 +1 @@
 import os
 import re
+
 
 from django.conf import settings
-from django.contrib.auth import SESSION_KEY
+from django.contrib.auth import SESSION_KEY
 from django.contrib.auth.forms import AuthenticationForm
 from django.contrib.sites.models import Site, RequestSite
 from django.contrib.auth.models import User
@@ -183 +184 @@
         self.assertEquals(response.context['site_name'], site.name)
         self.assert_(isinstance(response.context['form'], AuthenticationForm), 
                      'Login form is not an AuthenticationForm')
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
         
 class LogoutTest(AuthViewsTestCase):
     urls = 'django.contrib.auth.tests.urls'