mirror of
https://github.com/Icinga/icingaweb2.git
synced 2026-06-11 09:31:31 -04:00
8f52c7639e
Add `LoginRedirect` that extends `HiddenElement` with a single `getUrl()` method
that encapsulates the three-step redirect resolution used in both login and
two-factor challenge form: fall back to `LoginForm::REDIRECT_URL` when the value
is empty or points to the logout action, then reject external URLs with a 400.
`LoginForm` and `TwoFactorChallengeForm` both replace their plain `'hidden'`
element with `LoginRedirect` and drop their identical `createRedirectUrl()`
methods in favor of `$this->getElement('redirect')->getUrl()`.
`AuthenticationController::loginAction()` had a pre-assembly call to
`$form->createRedirectUrl()` for the already-authenticated path. At that point
`handleRequest()` has not yet been called, so the form is not assembled and the
`redirect` element does not exist — calling `getElement()` would throw. That
path is also only reached when no `redirect` query param is present (the param
is handled explicitly on the line above), so the call always returned the
fallback URL anyway. It is replaced with a direct
`Url::fromPath(LoginForm::REDIRECT_URL)`.
|
||
|---|---|---|
| .. | ||
| Button.php | ||
| Checkbox.php | ||
| CsrfCounterMeasure.php | ||
| Date.php | ||
| DateTimePicker.php | ||
| LoginRedirect.php | ||
| Note.php | ||
| Number.php | ||
| Textarea.php | ||
| Time.php | ||