GHSA-vqv8-j3mj-wjxj

### Summary The `trainer_login` view in wger redirects to `request.GET['next']` directly via `HttpResponseRedirect()` without calling `url_has_allowed_host_and_scheme()`. After the trainer successfully enters impersonation mode, their browser is redirected to any attacker-controlled URL supplied in the `?next=` parameter, enabling Referer exfiltration and phishing. ### Details **File**: `wger/core/views/user.py`, approximately line 203 ```python # VULNERABLE - wger/core/views/user.py if not own: request.session['trainer.identity'] = orig_user_pk if request.GET.get('next'): return HttpResponseRedirect(request.GET['next']) # no host/scheme validation ``` After the impersonation logic succeeds, the view performs no validation of the `next` parameter before issuing the redirect. An attacker who can deliver a crafted link (e.g. `/en/user/2/trainer-login?next=https://evil.example/steal`) to a trainer can redirect the trainer's browser to any external host immediately after the impersonation session is established. The `Location` header contains the raw attacker-controlled URL. **Affected endpoint**: - `GET /en/user/<user_pk>/trainer-login` -> `wger.core.views.user.trainer_login` (the `?next=` redirect branch) **Suggested patch**: ```diff --- a/wger/core/views/user.py +++ b/wger/core/views/user.py +from django.utils.http import url_has_allowed_host_and_scheme + if not own: request.session['trainer.identity'] = orig_user_pk - if request.GET.get('next'): - return HttpResponseRedirect(request.GET['next']) + next_url = request.GET.get('next') + if next_url and url_has_allowed_host_and_scheme( + next_url, allowed_hosts={request.get_host()}, require_https=request.is_secure() + ): + return HttpResponseRedirect(next_url) return HttpResponseRedirect(reverse('core:index')) ``` Adding `@require_POST` to `trainer_login` (see also VULN-030) moves the `next` parameter to the POST body where CSRF protection applies an