omab/python-social-auth — pull request #49 by volrath (2013-10-07 22:50:09+00:00)
Title: `sanitize_redirect` don't work with Django's `reverse_lazy`

Hello,

There's an issue when working with Django and setting some of the SOCIAL_AUTH_*_URL to `reverse_lazy` proxies. The problem is caused in two functions:

`sanitize_redirect`: Does a quick check first where ask if the given `redirect_to` is a True-able value and if it's instance of a string type (`six.string_types`). The problem here is that `reverse_lazy` returns a Django proxy (`reverse_lazy ~= lazy(reverse, str)`) and this is not validated by this first check, hence returning None.

`do_complete`: Here we call `sanitize_redirect` if the settings say so, but there's no checking if `sanitize_redirect` returns `None`. So, if this is the case, a misleading Exception is raised (`'NoneType' object has no attribute 'find'`) since url is set to None and after that, somewhere in the way, a `url.find(...)` is called.

I forked the project to provided solutions. For `sanitize_redirect` I'm using the `str.decode` method to force a `reverse_lazy` string to get evaluated. This was suggested as one of the solutions for this ticket: https://code.djangoproject.com/ticket/18776 The actual solution is better but is very django-dependent.

For `do_complete` I'm just adding the extra check after calling `sanitize_redirect`, maybe that check can be set in a lower indentation level.

Hope this helps.