Re: [Zope-dev] zope.pluggableauth and "camefrom" information in login form not an absolute URL

On 2/7/11 12:04 PM, Adam GROSZER wrote:

Hello,

I'm not sure whether you open up a security hole there. Imagine that someone does a http://yoursite.com/@@loginform.html?camefrom=http://mysite.com We ended up with storing the camefrom URL in a session variable.

The redirect method in the zope publisher checks whether the redirect is "trusted" to go to a different host. The trusted arguments is "False" by default. I think will catch this situation just fine. Or doesn't it? regards, jw