(allura) 08/14: [#8603] use _verify_return_to in pwd_expired_change

[ke...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git

commit 7013d3506ea793e738be2e3762b1376eef126fed
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Tue May 5 17:21:04 2026 -0400

    [#8603] use _verify_return_to in pwd_expired_change
---
 Allura/allura/controllers/auth.py           | 4 ++--
 Allura/allura/tests/functional/test_auth.py | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Allura/allura/controllers/auth.py b/Allura/allura/controllers/auth.py
index 669117200..6b7272d87 100644
--- a/Allura/allura/controllers/auth.py
+++ b/Allura/allura/controllers/auth.py
@@ -388,7 +388,7 @@ def logout(self, return_to=None):
         redirect(config.get('auth.post_logout_url', '/'))
 
     @staticmethod
-    def _verify_return_to(return_to):
+    def _verify_return_to(return_to: str | None) -> str:
         # protect against any "open redirect" attacks using an external URL
         if not return_to or '\n' in return_to:
             return_to = '/'
@@ -614,7 +614,7 @@ def pwd_expired(self, **kw):
     @validate(F.password_change_form, error_handler=pwd_expired)
     def pwd_expired_change(self, **kw):
         require_authenticated()
-        return_to = kw.get('return_to')
+        return_to = self._verify_return_to(kw.get('return_to'))
         ap = plugin.AuthenticationProvider.get(request)
         failure_redirect_url = tg.url('/auth/pwd_expired', dict(return_to=return_to))
 
diff --git a/Allura/allura/tests/functional/test_auth.py b/Allura/allura/tests/functional/test_auth.py
index 5db3a7f36..3893a4bda 100644
--- a/Allura/allura/tests/functional/test_auth.py
+++ b/Allura/allura/tests/functional/test_auth.py
@@ -2870,7 +2870,7 @@ def test_change_pwd_validation(self):
             assert 'Passwords must match' in r
             r = self.check_validation('bad', 'qwerty', 'qwerty')
             assert 'Incorrect password' in self.webflash(r)
-            assert r.location == 'http://localhost/auth/pwd_expired?return_to='
+            assert r.location == 'http://localhost/auth/pwd_expired?return_to=%2F'
 
             with h.push_config(config, **{'auth.min_password_len': 3}):
                 r = self.check_validation('foo', 'foo', 'foo')