timesketch

timesketch copied to clipboard

**Describe the bug** The `next` URL parameter used for redirecting the user post-login at `timesketch/views/auth.py#L165` can reference any domain, leading to an open redirect [CWE-601: URL Redirection to Untrusted Site...

jonathan-greig

If I run the following: ``` sketch.add_to_acl("admin") True (Pdb) admin_sketch_instance.acl {'user/test': ['read', 'write', 'delete'], 'is_public': False} ``` This is not what I would expect. The correct way to call the...

jaegeral