sanitize_redirect
don't work with Django's reverse_lazy
#49
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello,
There's an issue when working with Django and setting some of the SOCIAL_AUTH_*_URL to
reverse_lazy
proxies. The problem is caused in two functions:sanitize_redirect
: Does a quick check first where ask if the givenredirect_to
is a True-able value and if it's instance of a string type (six.string_types
). The problem here is thatreverse_lazy
returns a Django proxy (reverse_lazy ~= lazy(reverse, str)
) and this is not validated by this first check, hence returning None.do_complete
: Here we callsanitize_redirect
if the settings say so, but there's no checking ifsanitize_redirect
returnsNone
. So, if this is the case, a misleading Exception is raised ('NoneType' object has no attribute 'find'
) since url is set to None and after that, somewhere in the way, aurl.find(...)
is called.I forked the project to provided solutions. For
sanitize_redirect
I'm using thestr.decode
method to force areverse_lazy
string to get evaluated. This was suggested as one of the solutions for this ticket: https://code.djangoproject.com/ticket/18776 The actual solution is better but is very django-dependent.For
do_complete
I'm just adding the extra check after callingsanitize_redirect
, maybe that check can be set in a lower indentation level.Hope this helps.