yahoo-eng-team team mailing list archive

Thread
Date

[Bug 1625833] Re: Prevent open redirects as a result of workflow action

To: yahoo-eng-team@xxxxxxxxxxxxxxxxxxx
From: "Gary W. Smith" <gary.smith@xxxxxxxx>
Date: Tue, 31 Oct 2017 18:23:44 -0000
Reply-to: Bug 1625833 <1625833@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

** Changed in: horizon
       Status: In Progress => Opinion

** Changed in: horizon
     Assignee: Julie Gravel (julie-gravel) => (unassigned)

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Dashboard (Horizon).
https://bugs.launchpad.net/bugs/1625833

Title:
  Prevent open redirects as a result of workflow action

Status in OpenStack Dashboard (Horizon):
  Opinion
Status in OpenStack Security Advisory:
  Won't Fix

Bug description:
  For example:
  /admin/flavors/create/?next=http://www.foobar.com/

  If a user is tricked into clicking that link, the flavor create
  workflow will be shown, but the redirect on form post will
  unexpectedly take the user to another site.

  Prevent this by checking that the next_url in WorkflowView.post is
  same origin.

To manage notifications about this bug go to:
https://bugs.launchpad.net/horizon/+bug/1625833/+subscriptions