Re: [PATCH] Mitigating "Covert Redirect"

[Miroslav Suchý]

On 05/03/2014 04:28 AM, Ralph Bean wrote:
> Upgrading is
> probably the best bet, but it may cause other unforeseen issues.
>
> As a workaround, I've attached a second patch that tells copr to just ignore
> the 'next' parameter and redirect always back to the copr root url.  This
> second workaround patch is applied as a 'hotfix' in ansible and deployed to the
> copr cloud node.

I commited the first patch.
I would like to avoid that second one and rather do it properly and if it means upgrading to F20 then let it be.

I planned to do it for some time anyway. I will upgrade -dev instance and if everything will be ok, I will upgrade prod
next week.