[PATCH] Mitigating "Covert Redirect"

Miroslav Suchý msuchy at redhat.com
Mon May 5 07:01:31 UTC 2014


On 05/03/2014 04:28 AM, Ralph Bean wrote:
> Upgrading is
> probably the best bet, but it may cause other unforeseen issues.
> 
> As a workaround, I've attached a second patch that tells copr to just ignore
> the 'next' parameter and redirect always back to the copr root url.  This
> second workaround patch is applied as a 'hotfix' in ansible and deployed to the
> copr cloud node.

I commited the first patch.
I would like to avoid that second one and rather do it properly and if it means upgrading to F20 then let it be.

I planned to do it for some time anyway. I will upgrade -dev instance and if everything will be ok, I will upgrade prod
next week.

-- 
Miroslav Suchy, RHCE, RHCDS
Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys


More information about the copr-devel mailing list