mattupstate/flask-security — pull request #96 by invernizzi (2013-03-05 21:27:33+00:00)
Title: NextFormMixin security bug fixed: open redirect

NextFormMixin was missing validations check on redirection [1]. Only internal redirections
are now allowed.
Attack Example: http://127.0.0.1:5000/login?next=http://google.com (it should not redirect to google.com)
wq
[1] https://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards