fix(sec): fix unverified open redirect (#51)

chore: upgrade weasyprint

LedenAdministratie/utils.py

@@ -2,7 +2,9 @@
 
 from django.core.mail import EmailMessage
 from django.http.request import HttpRequest
+from django.shortcuts import reverse
 from oauth2_provider.models import AccessToken
+from urllib.parse import urlparse
 
 from LedenAdministratie.models import Setting
 
@@ -42,3 +44,12 @@ def get_access_token(request: HttpRequest) -> Optional[AccessToken]:
         except AccessToken.DoesNotExist:
             return None
         return token
+
+    @staticmethod
+    def get_safe_return_url(request: HttpRequest) -> str:
+        if url := request.META.get("HTTP_REFERER", ""):
+            print(f"REFER: {url}")
+            path = urlparse(url).path
+            if path.startswith("/"):
+                return path
+        return reverse("members")

LedenAdministratie/views.py

@@ -166,11 +166,7 @@ class MemberDeleteNoteView(OTPRequiredMixin, PermissionRequiredMixin, View):
     def get(self, request, *args, **kwargs):
         note = Note.objects.get(pk=kwargs["pk"])
         note.delete()
-        if "HTTP_REFERER" in request.META:
-            url = request.META["HTTP_REFERER"]
-        else:
-            url = reverse("members")
-        return HttpResponseRedirect(url)
+        return HttpResponseRedirect(Utils.get_safe_return_url(request))
 
 
 class MemberEditNoteView(OTPRequiredMixin, PermissionRequiredMixin, UpdateView):
@@ -267,11 +263,7 @@ class InvoiceDeleteView(OTPRequiredMixin, PermissionRequiredMixin, View):
     def get(self, request, *args, **kwargs):
         invoice = Invoice.objects.get(pk=kwargs["pk"])
         invoice.delete()
-        if "HTTP_REFERER" in request.META:
-            url = request.META["HTTP_REFERER"]
-        else:
-            url = reverse("members")
-        return HttpResponseRedirect(url)
+        return HttpResponseRedirect(Utils.get_safe_return_url(request))
 
 
 class InvoicePaymentView(OTPRequiredMixin, PermissionRequiredMixin, ListView):
@@ -524,8 +516,4 @@ class StripcardDeleteView(OTPRequiredMixin, PermissionRequiredMixin, View):
     def get(self, request, *args, **kwargs):
         stripcard = Stripcard.objects.get(pk=kwargs["pk"])
         stripcard.delete()
-        if "HTTP_REFERER" in request.META:
-            url = request.META["HTTP_REFERER"]
-        else:
-            url = reverse("members")
-        return HttpResponseRedirect(url)
+        return HttpResponseRedirect(Utils.get_safe_return_url(request))

requirements.txt

@@ -10,5 +10,5 @@ Pillow==10.2.0
 python-dateutil==2.8.2
 requests==2.31.0
 requests-oauthlib==1.3.1
-weasyprint==58.1
+weasyprint==60.2
 django-two-factor-auth[phonenumberslite,webauthn]==1.15.5