Prevented reverse() from generating URLs pointing to other hosts.

This is a security fix. Disclosure following shortly.

1 files changed, 5 insertions, 1 deletions

diff --git a/django/core/urlresolvers.py b/django/core/urlresolvers.py
index d3bfef423b..9a399466bc 100644
--- a/django/core/urlresolvers.py
+++ b/django/core/urlresolvers.py
@@ -456,7 +456,11 @@ class RegexURLResolver(LocaleRegexProvider):
                     # safe characters from `pchar` definition of RFC 3986
                     candidate_subs = dict((k, urlquote(v, safe=RFC3986_SUBDELIMS + str('/~:@')))
                                           for (k, v) in candidate_subs.items())
-                    return candidate_pat % candidate_subs
+                    url = candidate_pat % candidate_subs
+                    # Don't allow construction of scheme relative urls.
+                    if url.startswith('//'):
+                        url = '/%%2F%s' % url[2:]
+                    return url
         # lookup_view can be URL label, or dotted path, or callable, Any of
         # these can be passed in at the top, but callables are not friendly in
         # error messages.