diff options
Diffstat (limited to 'django/middleware')
| -rw-r--r-- | django/middleware/common.py | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/django/middleware/common.py b/django/middleware/common.py index d8cfb9a8b0..ea5e536655 100644 --- a/django/middleware/common.py +++ b/django/middleware/common.py @@ -11,6 +11,7 @@ from django.utils.cache import ( cc_delim_re, get_conditional_response, set_response_etag, ) from django.utils.deprecation import MiddlewareMixin, RemovedInDjango21Warning +from django.utils.http import escape_leading_slashes class CommonMiddleware(MiddlewareMixin): @@ -88,6 +89,8 @@ class CommonMiddleware(MiddlewareMixin): POST, PUT, or PATCH. """ new_path = request.get_full_path(force_append_slash=True) + # Prevent construction of scheme relative urls. + new_path = escape_leading_slashes(new_path) if settings.DEBUG and request.method in ('POST', 'PUT', 'PATCH'): raise RuntimeError( "You called this URL via %(method)s, but the URL doesn't end " |