vhad/plane
1
0
Fork 0
mirror of https://github.com/gosticks/plane.git synced 2025-10-16 12:45:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[WEB-4943] refactor: streamline URL construction in authentication views (#7806)

Browse Source 
* refactor: streamline URL construction in authentication views

* Updated MagicSignInSpaceEndpoint and MagicSignUpSpaceEndpoint to directly construct redirect URLs using formatted strings instead of the get_safe_redirect_url function.
* Enhanced get_safe_redirect_url to use quote for safer URL encoding of parameters.

* refactor: enhance URL validation and redirection in authentication views

* Added validate_next_path function to improve the safety of redirect URLs in MagicSignInSpaceEndpoint and MagicSignUpSpaceEndpoint.
* Updated URL construction to ensure proper handling of next_path and base_url.
* Streamlined the get_safe_redirect_url function for better parameter encoding.

* refactor: unify URL redirection logic across authentication views

* Introduced validate_next_path function to enhance URL safety in SignInAuthSpaceEndpoint, SignUpAuthSpaceEndpoint, GitHubCallbackSpaceEndpoint, GitLabCallbackSpaceEndpoint, and GoogleCallbackSpaceEndpoint.
* Updated URL construction to directly format the redirect URL, improving clarity and consistency across multiple authentication views.
This commit is contained in:
Nikhil 2025-09-16 18:44:26 +05:30 committed by GitHub
parent bf45635a7b
commit 4d17637edf
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
6 changed files with 23 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
apps/api/plane/authentication/views/space/email.py
View File

@ -14,7 +14,7 @@ from plane.authentication.adapter.error import (
AUTHENTICATION_ERROR_CODES, AUTHENTICATION_ERROR_CODES,
AuthenticationException, AuthenticationException,
) )
from plane.utils.path_validator import get_safe_redirect_url from plane.utils.path_validator import get_safe_redirect_url, validate_next_path
class SignInAuthSpaceEndpoint(View): class SignInAuthSpaceEndpoint(View):
@ -198,11 +198,8 @@ class SignUpAuthSpaceEndpoint(View):
# Login the user and record his device info # Login the user and record his device info
user_login(request=request, user=user, is_space=True) user_login(request=request, user=user, is_space=True)
# redirect to referer path # redirect to referer path
url = get_safe_redirect_url( next_path = validate_next_path(next_path=next_path)
base_url=base_host(request=request, is_space=True), url = f"{base_host(request=request, is_space=True).rstrip("/")}{next_path}"
next_path=next_path,
params={}
)
return HttpResponseRedirect(url) return HttpResponseRedirect(url)
except AuthenticationException as e: except AuthenticationException as e:
params = e.get_error_dict() params = e.get_error_dict()

9
apps/api/plane/authentication/views/space/github.py
View File

@ -14,7 +14,7 @@ from plane.authentication.adapter.error import (
AUTHENTICATION_ERROR_CODES, AUTHENTICATION_ERROR_CODES,
AuthenticationException, AuthenticationException,
) )
from plane.utils.path_validator import get_safe_redirect_url from plane.utils.path_validator import get_safe_redirect_url, validate_next_path
class GitHubOauthInitiateSpaceEndpoint(View): class GitHubOauthInitiateSpaceEndpoint(View):
@ -93,11 +93,8 @@ class GitHubCallbackSpaceEndpoint(View):
user_login(request=request, user=user, is_space=True) user_login(request=request, user=user, is_space=True)
# Process workspace and project invitations # Process workspace and project invitations
# redirect to referer path # redirect to referer path
url = get_safe_redirect_url( next_path = validate_next_path(next_path=next_path)
base_url=base_host(request=request, is_space=True), url = f"{base_host(request=request, is_space=True).rstrip("/")}{next_path}"
next_path=next_path,
params=params
)
return HttpResponseRedirect(url) return HttpResponseRedirect(url)
except AuthenticationException as e: except AuthenticationException as e:
params = e.get_error_dict() params = e.get_error_dict()

9
apps/api/plane/authentication/views/space/gitlab.py
View File

@ -14,7 +14,7 @@ from plane.authentication.adapter.error import (
AUTHENTICATION_ERROR_CODES, AUTHENTICATION_ERROR_CODES,
AuthenticationException, AuthenticationException,
) )
from plane.utils.path_validator import get_safe_redirect_url from plane.utils.path_validator import get_safe_redirect_url, validate_next_path
class GitLabOauthInitiateSpaceEndpoint(View): class GitLabOauthInitiateSpaceEndpoint(View):
@ -94,11 +94,8 @@ class GitLabCallbackSpaceEndpoint(View):
user_login(request=request, user=user, is_space=True) user_login(request=request, user=user, is_space=True)
# Process workspace and project invitations # Process workspace and project invitations
# redirect to referer path # redirect to referer path
url = get_safe_redirect_url( next_path = validate_next_path(next_path=next_path)
base_url=base_host(request=request, is_space=True), url = f"{base_host(request=request, is_space=True).rstrip("/")}{next_path}"
next_path=next_path,
params=params
)
return HttpResponseRedirect(url) return HttpResponseRedirect(url)
except AuthenticationException as e: except AuthenticationException as e:
params = e.get_error_dict() params = e.get_error_dict()

9
apps/api/plane/authentication/views/space/google.py
View File

@ -14,7 +14,7 @@ from plane.authentication.adapter.error import (
AuthenticationException, AuthenticationException,
AUTHENTICATION_ERROR_CODES, AUTHENTICATION_ERROR_CODES,
) )
from plane.utils.path_validator import get_safe_redirect_url from plane.utils.path_validator import get_safe_redirect_url, validate_next_path
class GoogleOauthInitiateSpaceEndpoint(View): class GoogleOauthInitiateSpaceEndpoint(View):
@ -90,11 +90,8 @@ class GoogleCallbackSpaceEndpoint(View):
# Login the user and record his device info # Login the user and record his device info
user_login(request=request, user=user, is_space=True) user_login(request=request, user=user, is_space=True)
# redirect to referer path # redirect to referer path
url = get_safe_redirect_url( next_path = validate_next_path(next_path=next_path)
base_url=base_host(request=request, is_space=True), url = f"{base_host(request=request, is_space=True).rstrip("/")}{next_path}"
next_path=next_path,
params=params
)
return HttpResponseRedirect(url) return HttpResponseRedirect(url)
except AuthenticationException as e: except AuthenticationException as e:
params = e.get_error_dict() params = e.get_error_dict()

12
apps/api/plane/authentication/views/space/magic.py
View File

@ -20,7 +20,7 @@ from plane.authentication.adapter.error import (
AuthenticationException, AuthenticationException,
AUTHENTICATION_ERROR_CODES, AUTHENTICATION_ERROR_CODES,
) )
from plane.utils.path_validator import get_safe_redirect_url from plane.utils.path_validator import get_safe_redirect_url, validate_next_path
class MagicGenerateSpaceEndpoint(APIView): class MagicGenerateSpaceEndpoint(APIView):
@ -94,9 +94,8 @@ class MagicSignInSpaceEndpoint(View):
# Login the user and record his device info # Login the user and record his device info
user_login(request=request, user=user, is_space=True) user_login(request=request, user=user, is_space=True)
# redirect to referer path # redirect to referer path
url = get_safe_redirect_url( next_path = validate_next_path(next_path=next_path)
base_url=base_host(request=request, is_space=True), next_path=next_path url = f"{base_host(request=request, is_space=True).rstrip("/")}{next_path}"
)
return HttpResponseRedirect(url) return HttpResponseRedirect(url)
except AuthenticationException as e: except AuthenticationException as e:
@ -154,9 +153,8 @@ class MagicSignUpSpaceEndpoint(View):
# Login the user and record his device info # Login the user and record his device info
user_login(request=request, user=user, is_space=True) user_login(request=request, user=user, is_space=True)
# redirect to referer path # redirect to referer path
url = get_safe_redirect_url( next_path = validate_next_path(next_path=next_path)
base_url=base_host(request=request, is_space=True), next_path=next_path url = f"{base_host(request=request, is_space=True).rstrip("/")}{next_path}"
)
return HttpResponseRedirect(url) return HttpResponseRedirect(url)
except AuthenticationException as e: except AuthenticationException as e:

12
apps/api/plane/utils/path_validator.py
View File

@ -1,7 +1,6 @@
# Python imports # Python imports
from urllib.parse import urlparse from urllib.parse import urlparse
def _contains_suspicious_patterns(path: str) -> bool: def _contains_suspicious_patterns(path: str) -> bool:
""" """
Check for suspicious patterns that might indicate malicious intent. Check for suspicious patterns that might indicate malicious intent.
@ -84,15 +83,16 @@ def get_safe_redirect_url(base_url: str, next_path: str = "", params: dict = {})
Returns: Returns:
str: The safe redirect URL str: The safe redirect URL
""" """
from urllib.parse import urlencode from urllib.parse import urlencode, quote
# Validate the next path # Validate the next path
validated_path = validate_next_path(next_path) validated_path = validate_next_path(next_path)
# Add the next path to the parameters # Add the next path to the parameters
if validated_path: base_url = base_url.rstrip('/')
params["next_path"] = validated_path if params:
encoded_params = urlencode(params)
return f"{base_url}/?next_path={validated_path}&{encoded_params}"
# Return the safe redirect URL return f"{base_url}/?next_path={validated_path}"
return f"{base_url.rstrip('/')}?{urlencode(params)}"