Browse Source

Fix url regexp.

\d allows numbers from other digit systems, so urls like: http://demo.getpinry.com/१७/ are possible. This could lead to some nasty security issues in the future (ie. if you try to use pin number without using `int(...)`).
pull/62/head
Tomasz Wysocki 10 years ago
parent
commit
bd984f9fd2
1 changed files with 1 additions and 1 deletions
  1. +1
    -1
      pinry/core/urls.py

+ 1
- 1
pinry/core/urls.py View File

@@ -30,7 +30,7 @@ urlpatterns = patterns('',
name='tag-pins'),
url(r'^pins/user/(?P<user>(\w|-)+)/$', TemplateView.as_view(template_name='core/pins.html'),
name='user-pins'),
url(r'^(?P<pin>\d+)/$', TemplateView.as_view(template_name='core/pins.html'),
url(r'^(?P<pin>[0-9]+)/$', TemplateView.as_view(template_name='core/pins.html'),
name='recent-pins'),
url(r'^$', TemplateView.as_view(template_name='core/pins.html'),
name='recent-pins'),


Loading…
Cancel
Save