[PATCH] Mitigating "Covert Redirect"

Miroslav Suchý msuchy at redhat.com
Mon May 5 06:55:53 UTC 2014


On 05/03/2014 04:28 AM, Ralph Bean wrote:
> The patch for this, at first glance, is very simple:
> 
> -oid = OpenID(app, app.config["OPENID_STORE"])
> +oid = OpenID(app, app.config["OPENID_STORE"], safe_roots=[])
> 
> However, the "safe_roots" argument to OpenID was only introduced in
> python-openid-1.2.  The copr frontend is running on Fedora 19 and so
> is, for the moment, stuck with python-openid-1.0.1.  Upgrading is
> probably the best bet, but it may cause other unforeseen issues.

Fedora 19 have python-openid-2.2.5-5.fc19.noarch, which seems much higher then 1.2 to me :)

So which version support
  safe_roots=[]
?

-- 
Miroslav Suchy, RHCE, RHCDS
Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys


More information about the copr-devel mailing list