[PATCH] Mitigating "Covert Redirect"
Ralph Bean
rbean at redhat.com
Mon May 5 13:28:08 UTC 2014
On Mon, May 05, 2014 at 08:55:53AM +0200, Miroslav Suchý wrote:
> On 05/03/2014 04:28 AM, Ralph Bean wrote:
> > The patch for this, at first glance, is very simple:
> >
> > -oid = OpenID(app, app.config["OPENID_STORE"])
> > +oid = OpenID(app, app.config["OPENID_STORE"], safe_roots=[])
> >
> > However, the "safe_roots" argument to OpenID was only introduced in
> > python-openid-1.2. The copr frontend is running on Fedora 19 and so
> > is, for the moment, stuck with python-openid-1.0.1. Upgrading is
> > probably the best bet, but it may cause other unforeseen issues.
>
> Fedora 19 have python-openid-2.2.5-5.fc19.noarch, which seems much higher then 1.2 to me :)
>
> So which version support
> safe_roots=[]
> ?
My apologies, I had the version number correct but typoed the package name.
python-flask-openid is the package to look at:
~❯ pkgwat releases python-flask-openid
+---------------+----------------+-----------------+
| release | stable_version | testing_version |
+---------------+----------------+-----------------+
| Rawhide | 1.2-1.fc21 | None |
| Fedora 20 | 1.2.1-1.fc20 | None |
| Fedora 19 | 1.0.1-5.fc19 | None |
| Fedora EPEL 7 | None | None |
| Fedora EPEL 6 | 1.2-1.el6 | None |
| Fedora EPEL 5 | None | None |
+---------------+----------------+-----------------+
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 473 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/copr-devel/attachments/20140505/518b475a/attachment.sig>
More information about the copr-devel
mailing list