Issue 14303: Fixes %3f problem with OAuth login

diff --git a/src/Module/OAuth/Acknowledge.php b/src/Module/OAuth/Acknowledge.php
index af17567591e0cb66f619b50d31a5b873f1628867..054e7a4ff77b1d252d8a48fab01b27a84eb29639 100644 (file)
--- a/src/Module/OAuth/Acknowledge.php
+++ b/src/Module/OAuth/Acknowledge.php
@@ -45,7 +45,7 @@ class Acknowledge extends BaseApi
 
        protected function content(array $request = []): string
        {
-               DI::session()->set('return_path', $_REQUEST['return_path'] ?? '');
+               DI::session()->set('return_path', 'oauth/authorize?' . $request['return_authorize']);
 
                $o = Renderer::replaceMacros(Renderer::getMarkupTemplate('oauth_authorize.tpl'), [
                        '$title'     => DI::l10n()->t('Authorize application connection'),

diff --git a/src/Module/OAuth/Authorize.php b/src/Module/OAuth/Authorize.php
index 7e19cc317c9c5934f1f6669dad5c494048a8bea8..920bccaa259772b5eb900dbbdc7975eb5f7bf2f3 100644 (file)
--- a/src/Module/OAuth/Authorize.php
+++ b/src/Module/OAuth/Authorize.php
@@ -68,19 +68,19 @@ class Authorize extends BaseApi
 
                $redirect_request = $_REQUEST;
                unset($redirect_request['pagename']);
-               $redirect = 'oauth/authorize?' . http_build_query($redirect_request);
+               $redirect = http_build_query($redirect_request);
 
                $uid = DI::userSession()->getLocalUserId();
                if (empty($uid)) {
                        Logger::info('Redirect to login');
-                       DI::app()->redirect('login?return_path=' . urlencode($redirect));
+                       DI::app()->redirect('login?' . http_build_query(['return_authorize' => $redirect]));
                } else {
                        Logger::info('Already logged in user', ['uid' => $uid]);
                }
 
                if (!OAuth::existsTokenForUser($application, $uid) && !DI::session()->get('oauth_acknowledge')) {
                        Logger::info('Redirect to acknowledge');
-                       DI::app()->redirect('oauth/acknowledge?' . http_build_query(['return_path' => $redirect, 'application' => $application['name']]));
+                       DI::app()->redirect('oauth/acknowledge?' . http_build_query(['return_authorize' => $redirect, 'application' => $application['name']]));
                }
 
                DI::session()->remove('oauth_acknowledge');

diff --git a/src/Module/Security/Login.php b/src/Module/Security/Login.php
index b73ffd41d376ae1f7e12f897f3361c67d3266a39..1ad25164d9baa183f00020333d2f9c5ed50c761f 100644 (file)
--- a/src/Module/Security/Login.php
+++ b/src/Module/Security/Login.php
@@ -60,7 +60,11 @@ class Login extends BaseModule
 
        protected function content(array $request = []): string
        {
-               $return_path = $request['return_path'] ?? $this->session->pop('return_path', '') ;
+               if (!empty($request['return_authorize'])) {
+                       $return_path = 'oauth/authorize?' . $request['return_authorize'];
+               } else {
+                       $return_path = $request['return_path'] ?? $this->session->pop('return_path', '') ;
+               }
 
                if ($this->session->getLocalUserId()) {
                        $this->baseUrl->redirect($return_path);