commit 2bc23b8448394e96d5562fcc7b69aa54bb2c1a38
author guido@google.com <guido@google.com> Thu Mar 24 10:44:17 2011 -0700
committer guido@google.com <guido@google.com> Thu Mar 24 10:44:17 2011 -0700
tree 6f149cc6725aec4b9ec8bbdd72d7c93d351c14b7
parent 60a4a90c8dd2972eb4bb977e70835be9593cbbac

Add FTP to the allowed url schemes. Add Misc/NEWS.

Lib/urllib.py

diff --git a/Lib/urllib.py b/Lib/urllib.py
index 09ce8c5..b835f52 100644
--- a/Lib/urllib.py
+++ b/Lib/urllib.py
@@ -643,10 +643,11 @@
         newurl = basejoin(self.type + ":" + url, newurl)
 
         # For security reasons we do not allow redirects to protocols
-        # other than HTTP or HTTPS.
+        # other than HTTP, HTTPS or FTP.
         newurl_lower = newurl.lower()
         if not (newurl_lower.startswith('http://') or
-                newurl_lower.startswith('https://')):
+                newurl_lower.startswith('https://') or
+                newurl_lower.startswith('ftp://')):
             return
 
         void = fp.read()

Lib/urllib2.py

diff --git a/Lib/urllib2.py b/Lib/urllib2.py
index db7ce81..0bb69a0 100644
--- a/Lib/urllib2.py
+++ b/Lib/urllib2.py
@@ -556,10 +556,11 @@
         newurl = urlparse.urljoin(req.get_full_url(), newurl)
 
         # For security reasons we do not allow redirects to protocols
-        # other than HTTP or HTTPS.
+        # other than HTTP, HTTPS or FTP.
         newurl_lower = newurl.lower()
         if not (newurl_lower.startswith('http://') or
-                newurl_lower.startswith('https://')):
+                newurl_lower.startswith('https://') or
+                newurl_lower.startswith('ftp://')):
             return
 
         # XXX Probably want to forget about the state of the current