@@ -25,8 +25,10 @@ public static function getReturnTo()
2525 {
2626 $ trust_root = self ::getTrustRoot ();
2727 $ return_to_url = $ trust_root . '/OpenStackIdAuthenticator?url=/OpenStackIdAuthenticator ' ;
28- if (Controller::curr ()->getRequest ()->getVar ('BackURL ' )){
29- $ back_url = Controller::curr ()->join_links ('/ ' , Controller::curr ()->getRequest ()->getVar ('BackURL ' ));
28+ $ back_url = Controller::curr ()->getRequest ()->getVar ('BackURL ' );
29+ if (!empty ($ back_url )){
30+ $ back_url = self ::cleanBackUrl ($ back_url );
31+ $ back_url = Controller::curr ()->join_links (Director::baseURL (), $ back_url );
3032 $ return_to_url .= '&BackURL= ' .urlencode ($ back_url );
3133 }
3234 return $ return_to_url ;
@@ -56,15 +58,16 @@ public static function getRedirectBackUrl(){
5658 }
5759 }
5860
59- if (!$ url ) $ url = Director::baseURL ();
61+ $ url = self ::cleanBackUrl ($ url );
62+
6063 if (strpos ($ url ,'/Security/login ' ) !== false ) $ url = Director::baseURL ();
64+
6165 return $ url ;
6266 }
6367
6468 public static function loginMember ($ member , $ back_url ){
65- if (!empty ($ back_url ) && !Director::is_site_url ($ back_url )){
66- return Controller::curr ()->httpError (403 );
67- }
69+
70+ $ back_url = self ::cleanBackUrl ($ back_url );
6871
6972 if (!defined ('OPENSTACKID_ENABLED ' ) || OPENSTACKID_ENABLED == false ){
7073 $ member ->login ();
@@ -74,4 +77,11 @@ public static function loginMember($member, $back_url){
7477 return Controller::curr ()->redirect ('/Security/login?BackURL= ' .$ back_url );
7578 }
7679 }
80+
81+ public static function cleanBackUrl ($ back_url ){
82+ if (empty ($ back_url ) || (!empty ($ back_url ) && !Director::is_site_url ($ back_url ))){
83+ $ back_url = Director::baseURL ();
84+ }
85+ return $ back_url ;
86+ }
7787}
0 commit comments