[1.6.x] Prevented reverse() from generating URLs pointing to other hosts.

This is a security fix. Disclosure following shortly.

1 files changed, 5 insertions, 1 deletions

diff --git a/django/core/urlresolvers.py b/django/core/urlresolvers.py
index b3008e88c4..4f251ab4ce 100644
--- a/django/core/urlresolvers.py
+++ b/django/core/urlresolvers.py
@@ -435,7 +435,11 @@ class RegexURLResolver(LocaleRegexProvider):
                 candidate_pat = prefix_norm.replace('%', '%%') + result
                 if re.search('^%s%s' % (prefix_norm, pattern), candidate_pat % candidate_subs, re.UNICODE):
                     candidate_subs = dict((k, urlquote(v)) for (k, v) in candidate_subs.items())
-                    return candidate_pat % candidate_subs
+                    url = candidate_pat % candidate_subs
+                    # Don't allow construction of scheme relative urls.
+                    if url.startswith('//'):
+                        url = '/%%2F%s' % url[2:]
+                    return url
         # lookup_view can be URL label, or dotted path, or callable, Any of
         # these can be passed in at the top, but callables are not friendly in
         # error messages.