diff options
author | Andrew Dolgov <[email protected]> | 2019-03-04 20:38:39 +0300 |
---|---|---|
committer | Andrew Dolgov <[email protected]> | 2019-03-04 20:38:39 +0300 |
commit | 5b3a73e574b5377300c86d8d9765b9c57df1ddd6 (patch) | |
tree | 98f618a2945d81c914dedee8c215cab2a1b1e83a /classes/handler | |
parent | e8edad377a4e89e67ac43786a4674def7b2516e3 (diff) |
login: switch to absolute redirect urls
Diffstat (limited to 'classes/handler')
-rwxr-xr-x | classes/handler/public.php | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/classes/handler/public.php b/classes/handler/public.php index c3f18d8bb..a8369f440 100755 --- a/classes/handler/public.php +++ b/classes/handler/public.php @@ -623,7 +623,7 @@ class Handler_Public extends Handler { } else { - $return = urlencode($_SERVER["REQUEST_URI"]) + $return = urlencode(make_self_url()); ?> @@ -712,7 +712,9 @@ class Handler_Public extends Handler { user_error("Failed login attempt for $login from {$_SERVER['REMOTE_ADDR']}", E_USER_WARNING); } - if (clean($_REQUEST['return'])) { + $return = clean($_REQUEST['return']); + + if ($_REQUEST['return'] && mb_strpos($return, SELF_URL_PATH) === 0) { header("Location: " . clean($_REQUEST['return'])); } else { header("Location: " . get_self_url_prefix()); |