diff options
| author | Lukas Klein <lukas@productgang.com> | 2015-02-11 11:09:51 +0100 |
|---|---|---|
| committer | Claude Paroz <claude@2xlibre.net> | 2015-02-12 09:01:59 +0100 |
| commit | 1904022f91d0e987d972359d98993422db11ab3f (patch) | |
| tree | c3f0903b017ccebef6cb9d4c324f36eb6660c84e /django/utils/http.py | |
| parent | a6ea62aeafd4512f6d13aeda908f7622776a4537 (diff) | |
[1.8.x] Fixed #24321 -- Improved `utils.http.same_origin` compliance with RFC6454
Backport of 93b3ef9b2e from master.
Diffstat (limited to 'django/utils/http.py')
| -rw-r--r-- | django/utils/http.py | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/django/utils/http.py b/django/utils/http.py index d732a9c825..33515eb410 100644 --- a/django/utils/http.py +++ b/django/utils/http.py @@ -33,6 +33,11 @@ ASCTIME_DATE = re.compile(r'^\w{3} %s %s %s %s$' % (__M, __D2, __T, __Y)) RFC3986_GENDELIMS = str(":/?#[]@") RFC3986_SUBDELIMS = str("!$&'()*+,;=") +PROTOCOL_TO_PORT = { + 'http': 80, + 'https': 443, +} + def urlquote(url, safe='/'): """ @@ -253,8 +258,10 @@ def same_origin(url1, url2): """ p1, p2 = urlparse(url1), urlparse(url2) try: - return (p1.scheme, p1.hostname, p1.port) == (p2.scheme, p2.hostname, p2.port) - except ValueError: + o1 = (p1.scheme, p1.hostname, p1.port or PROTOCOL_TO_PORT[p1.scheme]) + o2 = (p2.scheme, p2.hostname, p2.port or PROTOCOL_TO_PORT[p2.scheme]) + return o1 == o2 + except (ValueError, KeyError): return False |