[PATCH] Mitigating "Covert Redirect"

Ralph Bean rbean at redhat.com
Mon May 5 13:28:08 UTC 2014


On Mon, May 05, 2014 at 08:55:53AM +0200, Miroslav Suchý wrote:
> On 05/03/2014 04:28 AM, Ralph Bean wrote:
> > The patch for this, at first glance, is very simple:
> > 
> > -oid = OpenID(app, app.config["OPENID_STORE"])
> > +oid = OpenID(app, app.config["OPENID_STORE"], safe_roots=[])
> > 
> > However, the "safe_roots" argument to OpenID was only introduced in
> > python-openid-1.2.  The copr frontend is running on Fedora 19 and so
> > is, for the moment, stuck with python-openid-1.0.1.  Upgrading is
> > probably the best bet, but it may cause other unforeseen issues.
> 
> Fedora 19 have python-openid-2.2.5-5.fc19.noarch, which seems much higher then 1.2 to me :)
> 
> So which version support
>   safe_roots=[]
> ?

My apologies, I had the version number correct but typoed the package name.
python-flask-openid is the package to look at:

    ~❯ pkgwat releases python-flask-openid
    +---------------+----------------+-----------------+
    | release       | stable_version | testing_version |
    +---------------+----------------+-----------------+
    | Rawhide       | 1.2-1.fc21     | None            |
    | Fedora 20     | 1.2.1-1.fc20   | None            |
    | Fedora 19     | 1.0.1-5.fc19   | None            |
    | Fedora EPEL 7 | None           | None            |
    | Fedora EPEL 6 | 1.2-1.el6      | None            |
    | Fedora EPEL 5 | None           | None            |
    +---------------+----------------+-----------------+
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 473 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/copr-devel/attachments/20140505/518b475a/attachment.sig>


More information about the copr-devel mailing list