View Issue Detail

ID	Project	Category	Submitted / Last Updated
01440	UserSpice	Misc Code	2021-12-22 00:09:51 / 2022-11-06 22:12:39
Reported	Jamin Grey	Assigned To	Unassigned
Priority	none	Reported	5.3.9
Status	closed	Resolution Version and Commit
Summary	On /users/login.php, '?redirect=' doesn't work unless '?dest=' is also specified and in the database
Description	[ /users/login.php?redirect=my_url ] fails to to properly redirect me back to my_url after successful login. Here's an example: $redirect = urlencode($_SERVER['PHP_SELF']); echo "<a href='{$us_url_root}users/login.php?redirect=$redirect'>Log in</a>"; Instead of redirecting me back to $redirect, it just takes me back to the settings-defined redirect location. It seems you provide two ways to redirect in [users/login.php]: through ?redirect=url, or through ?dest=page_name_in_database.php It honors ?redirect=url ONLY IF ?dest= is ALSO present, and a valid filename of a page in the database. They don't even have to point to the same page. If any valid filename from the page database is present in ?dest=, then ?redirect=url will be followed, even if it's a different url. Behavior I want: On a successful login, ?redirect=my_url should redirect without the need of ?dest= On line 67 of login.php, you have this code: ------------------- login.php (line 67) ---------------------- if (!empty($dest)) { $redirect=html_entity_decode(Input::get('redirect')); if(!empty($redirect) \|\| $redirect!=='') Redirect::to($redirect); else Redirect::to($dest); } elseif (file_exists($abs_us_root.$us_url_root.'usersc/scripts/custom_login_script.php')) { -------------------------------------------------------------- I suggest it be replaced with this code: ------------------- login.php (line 67) ---------------------- $redirect = html_entity_decode(Input::get('redirect')); if(!empty($redirect)) { Redirect::to($redirect); } else if(!empty($dest)) { Redirect::to($dest); } else if (file_exists($abs_us_root.$us_url_root.'usersc/scripts/custom_login_script.php')) { --------------------------------------------------------------

December 2021

Some of the dest/redirect code is legacy and is hard to manipulate, especially with social logins. This needs to be a careful, well thought out adjustment if we make any changes.
December 2021

Agreed. This one isn't as obvious as it seems. We got this convoluted logic from shoehorning a bunch of other login options.
November 2022

Combined with other tickets because this is getting redone in 5.5