From 9a4a26e89809ade948c7ff8738a5f1abe040d707 Mon Sep 17 00:00:00 2001 From: David Anderson Date: Tue, 1 Dec 2015 23:49:31 -0800 Subject: [PATCH] web: fix the mechanism for forwarding to original page after login. --- html/user/login_action.php | 1 + html/user/login_form.php | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/html/user/login_action.php b/html/user/login_action.php index 20c5cf19c1..19ab82e8b2 100644 --- a/html/user/login_action.php +++ b/html/user/login_action.php @@ -133,6 +133,7 @@ if ($id && $t && $h) { } $next_url = post_str("next_url", true); +$next_url = urldecode($next_url); $next_url = sanitize_local_url($next_url); if (strlen($next_url) == 0) $next_url = "home.php"; diff --git a/html/user/login_form.php b/html/user/login_form.php index 42958332fa..b8cd271f4b 100644 --- a/html/user/login_form.php +++ b/html/user/login_form.php @@ -22,8 +22,10 @@ require_once("../inc/account.inc"); check_get_args(array("next_url")); -$next_url = sanitize_local_url(get_str('next_url', true)); +$next_url = get_str('next_url', true); $next_url = urldecode($next_url); +$next_url = sanitize_local_url($next_url); +$next_url = urlencode($next_url); $u = "login_form.php?next_url=".$next_url; redirect_to_secure_url($u);