Don't check for href prefix anymore

This doesn't really serve any security purposes at all.

Fix #91
Fix #87
This commit is contained in:
Markus Unterwaditzer 2014-08-04 18:34:11 +02:00
parent 667c10ef00
commit 59dd78dfd9

View file

@ -294,7 +294,6 @@ class DavStorage(Storage):
if not href:
raise ValueError(href)
x = utils.urlparse.urljoin(self.session.url, href)
assert x.startswith(self.session.url)
return utils.compat.urlunquote_plus(utils.urlparse.urlsplit(x).path)
def _get_href(self, item):