do not leak admin urls

aldryn · Apr 29, 2019 · 867205f · 867205f
1 parent 9e1b1dd
commit 867205f
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/aldryn_locations/cms_plugins.py b/aldryn_locations/cms_plugins.py
@@ -56,6 +56,12 @@ def render(self, context, instance, placeholder):
                     data = '{}{}'.format(base_url, data)
                 path_sources.append(data)
             else:
+                if not request.toolbar or not (
+                    getattr(request.toolbar, 'edit_mode')
+                    or getattr(request.toolbar, 'edit_mode_active')
+                ):
+                    # do not leak /admin urls
+                    data['admin'] = None
                 location_data.append(data)
 
         # Options for the map comes from plugin so I assigned it here