* auth_internal OTP form: fix double-urlencode

 * post-login redirect: handle ?return in a less idiotic fashion

1 files changed, 3 insertions, 3 deletions

diff --git a/classes/handler/public.php b/classes/handler/public.php
index d776e27cd..d7a7010fe 100755
--- a/classes/handler/public.php
+++ b/classes/handler/public.php
@@ -416,10 +416,10 @@ class Handler_Public extends Handler {
 				$_SESSION["login_error_msg"] ??= __("Incorrect username or password");
 			}
 
-			$return = clean($_REQUEST['return']);
+			$return = clean($_REQUEST['return'] ?? '');
 
-			if ($_REQUEST['return'] && mb_strpos($return, Config::get_self_url()) === 0) {
-				header("Location: " . clean($_REQUEST['return']));
+			if ($return && mb_strpos($return, Config::get_self_url()) === 0) {
+				header("Location: $return");
 			} else {
 				header("Location: " . Config::get_self_url());
 			}