Switch for sanitize redirect call

diff --git a/README.rst b/README.rst
index 3feeeac019a213671daeee200b52cb1267b237cf..962006638e45a842041dd3f4119b22f4d7f7d4e5 100644 (file)
--- a/README.rst
+++ b/README.rst
@@ -303,6 +303,11 @@ Configuration
 
       <uppercase backend name>_AUTH_EXTRA_ARGUMENTS = {...}
 
+- By default the application doesn't make redirects to different domains, to
+  disable this behavior::
+
+      SOCIAL_AUTH_SANITIZE_REDIRECTS = False
+
 
 -------
 Signals

diff --git a/doc/configuration.rst b/doc/configuration.rst
index 7ed85fb318d42f0b98712732b69ee2225e981278..74144d942832a361432a12d0bb4d50e16a330cf5 100644 (file)
--- a/doc/configuration.rst
+++ b/doc/configuration.rst
@@ -207,6 +207,11 @@ Configuration
 
       <uppercase backend name>_AUTH_EXTRA_ARGUMENTS = {...}
 
+- By default the application doesn't make redirects to different domains, to
+  disable this behavior::
+
+      SOCIAL_AUTH_SANITIZE_REDIRECTS = False
+
 
 .. _Model Manager: http://docs.djangoproject.com/en/dev/topics/db/managers/#managers
 .. _Login URL: http://docs.djangoproject.com/en/dev/ref/settings/?from=olddocs#login-url

diff --git a/social_auth/views.py b/social_auth/views.py
index cb32e6832913364285b62d5c1db23d43556302f3..d084fb8b874a1180420a17480acd0130d2d9c45e 100644 (file)
--- a/social_auth/views.py
+++ b/social_auth/views.py
@@ -40,6 +40,7 @@ BACKEND_ERROR_REDIRECT = _setting('SOCIAL_AUTH_BACKEND_ERROR_URL',
                                   LOGIN_ERROR_URL)
 ERROR_KEY = _setting('SOCIAL_AUTH_BACKEND_ERROR', 'socialauth_backend_error')
 NAME_KEY = _setting('SOCIAL_AUTH_BACKEND_KEY', 'socialauth_backend_name')
+SANITIZE_REDIRECTS = _setting('SOCIAL_AUTH_SANITIZE_REDIRECTS', True)
 
 
 def dsa_view(redirect_name=None):
@@ -134,8 +135,10 @@ def auth_process(request, backend):
         data = request.POST if request.method == 'POST' else request.GET
         if REDIRECT_FIELD_NAME in data:
             # Check and sanitize a user-defined GET/POST redirect_to field value.
-            redirect = sanitize_redirect(request.get_host(),
-                                         data[REDIRECT_FIELD_NAME])
+            redirect = data[REDIRECT_FIELD_NAME]
+
+            if SANITIZE_REDIRECTS:
+                redirect = sanitize_redirect(request.get_host(), redirect)
             request.session[REDIRECT_FIELD_NAME] = redirect or DEFAULT_REDIRECT
 
     if backend.uses_redirect: