Merge branch 'security-session-set' into 'main'

Do not allow setting arbitrary session data

See merge request pretix/pretix-payone!2

Author: raphaelm

pretix_payone/payment.py

@@ -580,7 +580,7 @@ def redirect(self, request, url):
                             ],
                         },
                     },
-                    salt="safe-redirect",
+                    salt="plugins:payone:redirect:safe-redirect-data",
                 )
             )
         else:

pretix_payone/views.py

@@ -28,14 +28,18 @@
 @xframe_options_exempt
 def redirect_view(request, *args, **kwargs):
     try:
-        data = signing.loads(request.GET.get("data", ""), salt="safe-redirect")
+        data = signing.loads(
+            request.GET.get("data", ""),
+            salt="plugins:payone:redirect:safe-redirect-data",
+        )
     except signing.BadSignature:
         return HttpResponseBadRequest("Invalid parameter")
 
     if "go" in request.GET:
         if "session" in data:
             for k, v in data["session"].items():
-                request.session[k] = v
+                if k.startswith("payment_payone_"):
+                    request.session[k] = v
         return redirect(data["url"])
     else:
         params = request.GET.copy()