Fix URL redirection from remote source

Fixes #1518

Author: ihalaij1

exercise/views.py

@@ -10,6 +10,7 @@
 from django.utils.decorators import method_decorator
 from django.utils.translation import gettext_lazy as _, get_language
 from django.utils.text import format_lazy
+from django.utils.http import url_has_allowed_host_and_scheme
 from django.views.decorators.clickjacking import xframe_options_exempt
 from django.views.decorators.csrf import csrf_exempt
 from django.db import DatabaseError
@@ -62,7 +63,10 @@ def post(self, request, *args, **kwargs):
         SubmissionTagging.objects.create(submission=submission, tag=subtag)
 
         # Redirect back to the previous page
-        return redirect(request.headers.get('referer', '/'))
+        referer = request.headers.get('referer', '/')
+        if not url_has_allowed_host_and_scheme(url=referer, allowed_hosts={request.get_host()}):
+            referer = '/'
+        return redirect(referer)
 
 
 class SubmissionTaggingRemoveView(CourseInstanceBaseView):
@@ -80,7 +84,10 @@ def post(self, request, *args, **kwargs):
         SubmissionTagging.objects.filter(submission=submission, tag=subtag).delete()
 
         # Redirect back to the previous page
-        return redirect(request.headers.get('referer', '/'))
+        referer = request.headers.get('referer', '/')
+        if not url_has_allowed_host_and_scheme(url=referer, allowed_hosts={request.get_host()}):
+            referer = '/'
+        return redirect(referer)
 
 
 class ExerciseInfoView(ExerciseBaseView):

userprofile/views.py

@@ -368,4 +368,7 @@ class PseudonymizeView(BaseView):
     def get(self, request: HttpRequest) -> HttpResponse:
         pseudonymize = request.session.get("pseudonymize", False)
         request.session["pseudonymize"] = not pseudonymize
-        return HttpResponseRedirect(request.headers.get("referer", "/"))
+        referer = request.headers.get('referer', '/')
+        if not url_has_allowed_host_and_scheme(url=referer, allowed_hosts={request.get_host()}):
+            referer = '/'
+        return HttpResponseRedirect(referer)