misc: clean URIs missing a trailing slash (#40801)

combo/public/views.py

@@ -487,9 +487,11 @@ def page(request):
         hierarchy_ids.append(page.id)
 
     if not url.endswith('/') and settings.APPEND_SLASH:
-        # this is useful to allow /login, /manage, and other non-page
-        # URLs to work.
-        return HttpResponsePermanentRedirect(url + '/')
+        # this is useful to allow /login, /manage, and other non-page URLs to
+        # work. re.sub is used to replace repeated slashes by single ones,
+        # this prevents a double slash at the start to redirect to a
+        # //whatever service, which would be interpreted as http[s]://whatever/.
+        return HttpResponsePermanentRedirect(re.sub('/+', '/', url) + '/')
 
     if page is None:
         redirect = Redirect.objects.filter(old_url=url).last()

tests/test_public.py

@@ -958,3 +958,11 @@ def test_cell_slugs(app):
     resp = app.get('/', status=200)
     assert 'id="unique"' in resp.text
     assert 'id="dup"' not in resp.text
+
+
+def test_missing_trailing_slashes(app):
+    # redirect to path with slash
+    assert urlparse.urlparse(app.get('/login', status=301).location).path == '/login/'
+    assert urlparse.urlparse(app.get('/foo', status=301).location).path == '/foo/'
+    # don't be tricked by double slashes
+    assert urlparse.urlparse(app.get('//foo', status=301).location).path == '/foo/'