diff options
Diffstat (limited to 'django')
| -rw-r--r-- | django/core/urlresolvers.py | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/django/core/urlresolvers.py b/django/core/urlresolvers.py index d3bfef423b..9a399466bc 100644 --- a/django/core/urlresolvers.py +++ b/django/core/urlresolvers.py @@ -456,7 +456,11 @@ class RegexURLResolver(LocaleRegexProvider): # safe characters from `pchar` definition of RFC 3986 candidate_subs = dict((k, urlquote(v, safe=RFC3986_SUBDELIMS + str('/~:@'))) for (k, v) in candidate_subs.items()) - return candidate_pat % candidate_subs + url = candidate_pat % candidate_subs + # Don't allow construction of scheme relative urls. + if url.startswith('//'): + url = '/%%2F%s' % url[2:] + return url # lookup_view can be URL label, or dotted path, or callable, Any of # these can be passed in at the top, but callables are not friendly in # error messages. |