diff options
| author | Przemysław Suliga <mail@suligap.net> | 2018-06-22 11:21:52 +0200 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2018-06-29 10:17:52 -0400 |
| commit | d22b90b4eabc1fe9b7b35aada441e0edf5ebd6d8 (patch) | |
| tree | 9dcafc8e840de7fc1f2fc11aa818bfd2fd557557 /django/utils/http.py | |
| parent | b5dd6ef3d52544ec7533509915c61545d5c3d85a (diff) | |
Fixed #29525 -- Allowed is_safe_url()'s allowed_hosts arg to be a string.
Diffstat (limited to 'django/utils/http.py')
| -rw-r--r-- | django/utils/http.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/django/utils/http.py b/django/utils/http.py index 4558c6874a..caaab4f9e5 100644 --- a/django/utils/http.py +++ b/django/utils/http.py @@ -298,6 +298,8 @@ def is_safe_url(url, allowed_hosts, require_https=False): return False if allowed_hosts is None: allowed_hosts = set() + elif isinstance(allowed_hosts, str): + allowed_hosts = {allowed_hosts} # Chrome treats \ completely as / in paths but it could be part of some # basic auth credentials so we need to check both URLs. return (_is_safe_url(url, allowed_hosts, require_https=require_https) and |