Merge pull request #13 from ipython/next_url

restrict login redirect to notebook app

closes  #8314

IPython/html/auth/login.py

@@ -25,7 +25,11 b' class LoginHandler(IPythonHandler):'
 
     def get(self):
         if self.current_user:
-            self.redirect(self.get_argument('next', default=self.base_url))
+            next_url = self.get_argument('next', default=self.base_url)
+            if not next_url.startswith(self.base_url):
+                # require that next_url be absolute path within our path
+                next_url = self.base_url
+            self.redirect(next_url)
         else:
             self._render()
     
@@ -48,7 +52,11 b' class LoginHandler(IPythonHandler):'
                 self._render(message={'error': 'Invalid password'})
                 return
 
-        self.redirect(self.get_argument('next', default=self.base_url))
+        next_url = self.get_argument('next', default=self.base_url)
+        if not next_url.startswith(self.base_url):
+            # require that next_url be absolute path within our path
+            next_url = self.base_url
+        self.redirect(next_url)
     
     @classmethod
     def get_user(cls, handler):