Fixed #29525 -- Allowed is_safe_url()'s allowed_hosts arg to be a string.

1 files changed, 2 insertions, 0 deletions

diff --git a/django/utils/http.py b/django/utils/http.py
index 4558c6874a..caaab4f9e5 100644
--- a/django/utils/http.py
+++ b/django/utils/http.py
@@ -298,6 +298,8 @@ def is_safe_url(url, allowed_hosts, require_https=False):
         return False
     if allowed_hosts is None:
         allowed_hosts = set()
+    elif isinstance(allowed_hosts, str):
+        allowed_hosts = {allowed_hosts}
     # Chrome treats \ completely as / in paths but it could be part of some
     # basic auth credentials so we need to check both URLs.
     return (_is_safe_url(url, allowed_hosts, require_https=require_https) and