Internal
Public Access
Keith SmithandClaude Sonnet 4.5
e5b15c7193
Fixed open redirect vulnerability in 9 locations throughout tasks/views.py. Changes: - Added url_has_allowed_host_and_scheme import from django.utils.http - Created safe_redirect() helper function to validate redirect URLs - Only allows relative URLs or URLs to the same host - Prevents attackers from redirecting users to phishing/malicious sites Fixed locations: - Line 447: TaskUpdateView - task update redirect - Line 501: task_quick_add - quick add redirect - Line 521: subtask_create - subtask creation redirect - Line 537: task_toggle_status - status toggle redirect - Line 549: task_delete - task deletion redirect - Line 601: web_timer_start - timer start redirect - Line 626: web_timer_stop - timer stop redirect - Line 672: TagUpdateView - tag update redirect - Line 684: tag_delete - tag deletion redirect Security impact: - Prevents phishing attacks via malicious redirect URLs - Blocks cache poisoning attacks - Ensures users stay within the application domain 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>