Make external urls always with https

1 files changed, 12 insertions, 1 deletions

diff --git a/utils.py b/utils.py
index 573345d..595f770 100644
--- a/utils.py
+++ b/utils.py
@@ -9,7 +9,8 @@ from base64 import urlsafe_b64encode, urlsafe_b64decode
 from Crypto.Cipher import AES
 from email.mime.text import MIMEText
 from functools import wraps
-from flask import current_app, flash, g, redirect, render_template, request, session, url_for
+from flask import current_app, flash, g, redirect, render_template, request, session
+from flask import url_for as flask_url_for
 from flask.ext.wtf import ValidationError
 from hashlib import sha1
 from random import randint
@@ -227,3 +228,13 @@ class NotRegexp(Regexp):
                 self.message = field.gettext(u'Invalid input.')
 
             raise ValidationError(self.message)
+
+
+def url_for(endpoint, **values):
+    """Wrap `flask.url_for` so that it always returns https links"""
+    #XXX: Drop this in favor of config.PREFERRED_URL_SCHEME when we require Flask 0.9
+    u = flask_url_for(endpoint, **values)
+    if '_external' in values and u.startswith('http://'):
+        return 'https://' + u[7:]
+    else:
+        return u