| 658 | # have already seen. Do this by adding a handler-specific |
| 659 | # attribute to the Request object. |
| 660 | def http_error_302(self, req, fp, code, msg, headers): |
| 661 | # Some servers (incorrectly) return multiple Location headers |
| 662 | # (so probably same goes for URI). Use first header. |
| 663 | if "location" in headers: |
| 664 | newurl = headers["location"] |
| 665 | elif "uri" in headers: |
| 666 | newurl = headers["uri"] |
| 667 | else: |
| 668 | return |
| 669 | |
| 670 | # fix a possible malformed URL |
| 671 | urlparts = urlparse(newurl) |
| 672 | |
| 673 | # For security reasons we don't allow redirection to anything other |
| 674 | # than http, https or ftp. |
| 675 | |
| 676 | if urlparts.scheme not in ('http', 'https', 'ftp', ''): |
| 677 | raise HTTPError( |
| 678 | newurl, code, |
| 679 | "%s - Redirection to url '%s' is not allowed" % (msg, newurl), |
| 680 | headers, fp) |
| 681 | |
| 682 | if not urlparts.path and urlparts.netloc: |
| 683 | urlparts = list(urlparts) |
| 684 | urlparts[2] = "/" |
| 685 | newurl = urlunparse(urlparts) |
| 686 | |
| 687 | # http.client.parse_headers() decodes as ISO-8859-1. Recover the |
| 688 | # original bytes and percent-encode non-ASCII bytes, and any special |
| 689 | # characters such as the space. |
| 690 | newurl = quote( |
| 691 | newurl, encoding="iso-8859-1", safe=string.punctuation) |
| 692 | newurl = urljoin(req.full_url, newurl) |
| 693 | |
| 694 | # XXX Probably want to forget about the state of the current |
| 695 | # request, although that might interact poorly with other |
| 696 | # handlers that also use handler-specific request attributes |
| 697 | new = self.redirect_request(req, fp, code, msg, headers, newurl) |
| 698 | if new is None: |
| 699 | return |
| 700 | |
| 701 | # loop detection |
| 702 | # .redirect_dict has a key url if url was previously visited. |
| 703 | if hasattr(req, 'redirect_dict'): |
| 704 | visited = new.redirect_dict = req.redirect_dict |
| 705 | if (visited.get(newurl, 0) >= self.max_repeats or |
| 706 | len(visited) >= self.max_redirections): |
| 707 | raise HTTPError(req.full_url, code, |
| 708 | self.inf_msg + msg, headers, fp) |
| 709 | else: |
| 710 | visited = new.redirect_dict = req.redirect_dict = {} |
| 711 | visited[newurl] = visited.get(newurl, 0) + 1 |
| 712 | |
| 713 | # Don't close the fp until we are sure that we won't use it |
| 714 | # with HTTPError. |
| 715 | fp.read() |
| 716 | fp.close() |
| 717 | |