fix: properly forward return urls where missing

2026-08-11 14:34:46 +02:00
parent 102e1c1c3c
commit 48cd2d6b67
27 changed files with 194 additions and 24 deletions
@@ -8,9 +8,15 @@ trait ReturnUrlTrait
 {
    public function getReturnUrl(Request $request, string $defaultRoute, array $parameters = []): string
    {
-        $defaultUrl = $this->generateUrl($defaultRoute, $parameters);
+        $returnUrl = $request->query->get('r');

-        return rawurldecode($request->query->get('r', $defaultUrl));
+        // An empty "r" reaches us whenever a link forwards a return url it never got
+        // itself, it must not be mistaken for a return url pointing at the root.
+        if (false === is_string($returnUrl) || '' === $returnUrl) {
+            return $this->generateUrl($defaultRoute, $parameters);
+        }
+
+        return rawurldecode($returnUrl);
    }

    /**