security: fix open redirect vulnerabilities

gip-inclusion · Jan 31, 2025 · a07e85f · a07e85f
1 parent 1d7b939
commit a07e85f
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/itou/www/apply/views/process_views.py b/itou/www/apply/views/process_views.py
@@ -957,10 +957,12 @@ def geiq_eligibility(request, job_application_id, template_name="apply/process_g
     queryset = JobApplication.objects.is_active_company_member(request.user)
     # Check GEIQ eligibility during job application process
     job_application = get_object_or_404(queryset, pk=job_application_id)
-    back_url = request.GET.get("back_url") or reverse(
-        "apply:details_for_company", kwargs={"job_application_id": job_application.pk}
+    back_url = get_safe_url(
+        request,
+        "back_url",
+        fallback_url=reverse("apply:details_for_company", kwargs={"job_application_id": job_application.pk}),
     )
-    next_url = request.GET.get("next_url")
+    next_url = get_safe_url(request, "next_url")
     return common_views._geiq_eligibility(
         request,
         job_application.to_company,

diff --git a/itou/www/employee_record_views/views.py b/itou/www/employee_record_views/views.py
@@ -237,7 +237,7 @@ def create(request, job_application_id, template_name="employee_record/create.ht
         "steps": STEPS,
         "step": 1,
         "matomo_custom_title": "Nouvelle fiche salarié ASP - Étape 1",
-        "back_url": request.GET.get("back_url"),
+        "back_url": get_safe_url(request, "back_url"),
     }
 
     return render(request, template_name, context)