{"action":"closed","issue":{"url":"https://api.github.com/repos/openhatch/oh-mainline/issues/1267","labels_url":"https://api.github.com/repos/openhatch/oh-mainline/issues/1267/labels{/name}","comments_url":"https://api.github.com/repos/openhatch/oh-mainline/issues/1267/comments","events_url":"https://api.github.com/repos/openhatch/oh-mainline/issues/1267/events","html_url":"https://github.com/openhatch/oh-mainline/issues/1267","id":39788571,"number":1267,"title":"Open redirect in logout URL","user":{"login":"imported-from-roundup","id":8380203,"avatar_url":"https://avatars.githubusercontent.com/u/8380203?v=3","gravatar_id":"","url":"https://api.github.com/users/imported-from-roundup","html_url":"https://github.com/imported-from-roundup","followers_url":"https://api.github.com/users/imported-from-roundup/followers","following_url":"https://api.github.com/users/imported-from-roundup/following{/other_user}","gists_url":"https://api.github.com/users/imported-from-roundup/gists{/gist_id}","starred_url":"https://api.github.com/users/imported-from-roundup/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/imported-from-roundup/subscriptions","organizations_url":"https://api.github.com/users/imported-from-roundup/orgs","repos_url":"https://api.github.com/users/imported-from-roundup/repos","events_url":"https://api.github.com/users/imported-from-roundup/events{/privacy}","received_events_url":"https://api.github.com/users/imported-from-roundup/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/openhatch/oh-mainline/labels/pri:bug","name":"pri:bug","color":"f7c6c7"},{"url":"https://api.github.com/repos/openhatch/oh-mainline/labels/stat:reopened","name":"stat:reopened","color":"89bc84"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2014-08-08T02:58:06Z","updated_at":"2015-04-13T17:59:06Z","closed_at":"2015-04-13T17:59:06Z","body":"<b>Comment by <a href='https://openhatch.org/people/brittag/'>brittag</a>:</b><dl><dd>We got a report via email (thanks @M7K911) that <a href=\"http://openhatch.org/account/logout/?\">http://openhatch.org/account/logout/?</a>\nnext=http:///<a href=\"http://www.google.com\">www.google.com</a> works as an open redirect, and it probably shouldn't. This seems \nespecially interesting because <a href=\"http://openhatch.org/account/logout/?next=http://www.google.com\">http://openhatch.org/account/logout/?next=http://www.google.com</a> \n(with two slashes instead of three) just shows Django's \"logged out\" page.\n   \n</dl></dd><hr/>\n\n<b>Comment by <a href='https://openhatch.org/people/mattskone/'>mattskone</a>:</b><dl><dd>This pull request contains the proposed fix: <a href=\"https://github.com/openhatch/oh-mainline/pull/234\">https://github.com/openhatch/oh-mainline/pull/234</a>\n   \n</dl></dd><hr/>\n\n<b>Comment by <a href='https://openhatch.org/people/paulproteus/'>paulproteus</a>:</b><dl><dd>I +1'd this and merged it. I also just deployed.\n\nHuge thanks to all.\n   \n</dl></dd><hr/>\n\n<b>Comment by <a href='https://openhatch.org/people/MTK/'>MTK</a>:</b><dl><dd>Hi @M7K911 here i just review the patch it's nicely patched there is another\nOpen redirect on different page but on same parameter here is the P.O.C .\n\n<a href=\"http://openhatch.org/openid/register/?next=http://evil.com\">http://openhatch.org/openid/register/?next=http://evil.com</a>\n\nin this case user need to be logged in in order to get successfully redirected.\n   \n</dl></dd><hr/>\n\n\nStatus: <b>reopened</b>\nNosy List: <b>  brittag, mattskone, paulproteus </b>\nPriority: <b>bug</b>\nImported from roundup ID: <b>952</b> (<a href='http://roundup-archive.openhatch.org/bugs/issue952'>view archived page</a>)\nLast modified: <b>2014-05-06.13:52:38</b>\n"}}