Restrict docs page names in url map
authorMagnus Hagander <magnus@hagander.net>
Mon, 8 Mar 2021 20:57:38 +0000 (21:57 +0100)
committerMagnus Hagander <magnus@hagander.net>
Mon, 8 Mar 2021 20:59:18 +0000 (21:59 +0100)
Match only filenames, not subdirectory+filename. A subdir+filename would
just generate a 404 in most cases, but it could in some cases generate
incorrect redirects that could leave a client stuck in a loop until the
URL got long enough to start failing, which is obviously not very good
behaviour.

Also dont' match an empty filename with just an extension because, well,
that's stupid.

pgweb/urls.py

index db4a0234a21c4f4c7707a1bb57f762c68d598940..64fb616b681971a2655769c94b8b4b56e8611dc4 100644 (file)
@@ -60,9 +60,9 @@ urlpatterns = [
     url(r'^docs/release/$', pgweb.docs.views.release_notes),
     url(r'^docs/release/((?P<major_version>(\d+\.\d+)|\d+)\.(?P<minor_version>\d+))/$', pgweb.docs.views.release_notes),
     # Legacy URLs for accessing the docs page; provides a permanent redirect
-    url(r'^docs/(current|devel|\d+(?:\.\d)?)/(static|interactive)/((.*).html?)?$', pgweb.docs.views.docspermanentredirect),
-    url(r'^docs/(current|devel|\d+(?:\.\d)?)/(.*).html?$', pgweb.docs.views.docpage),
-    url(r'^docs/(current|devel|\d+(?:\.\d)?)/(.*).svg$', pgweb.docs.views.docsvg),
+    url(r'^docs/(current|devel|\d+(?:\.\d)?)/(static|interactive)/(([^/]+).html?)?$', pgweb.docs.views.docspermanentredirect),
+    url(r'^docs/(current|devel|\d+(?:\.\d)?)/([^/]+).html?$', pgweb.docs.views.docpage),
+    url(r'^docs/(current|devel|\d+(?:\.\d)?)/([^/]+).svg$', pgweb.docs.views.docsvg),
     url(r'^docs/(current|devel|\d+(?:\.\d)?)/$', pgweb.docs.views.docsrootpage),
     url(r'^docs/(current|devel|\d+(?:\.\d)?)/$', pgweb.docs.views.redirect_root),