From: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
Date: Fri, 10 Apr 2020 06:50:15 +0000 (+0200)
Subject: Fix absolute redirect
X-Git-Tag: v19.0.0beta3~9^2
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=refs%2Fpull%2F20401%2Fhead;p=nextcloud-server.git

Fix absolute redirect

Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
---

diff --git a/core/Controller/LoginController.php b/core/Controller/LoginController.php
index b3f7bb310ba..60fd22bd0d1 100644
--- a/core/Controller/LoginController.php
+++ b/core/Controller/LoginController.php
@@ -260,7 +260,7 @@ class LoginController extends Controller {
 
 	private function generateRedirect(?string $redirectUrl): RedirectResponse {
 		if ($redirectUrl !== null && $this->userSession->isLoggedIn()) {
-			$location = $this->urlGenerator->getAbsoluteURL(urldecode($redirectUrl));
+			$location = $this->urlGenerator->getAbsoluteURL($redirectUrl);
 			// Deny the redirect if the URL contains a @
 			// This prevents unvalidated redirects like ?redirect_url=:user@domain.com
 			if (strpos($location, '@') === false) {
diff --git a/tests/Core/Controller/LoginControllerTest.php b/tests/Core/Controller/LoginControllerTest.php
index 80be53ed26d..e9d4a89aa7d 100644
--- a/tests/Core/Controller/LoginControllerTest.php
+++ b/tests/Core/Controller/LoginControllerTest.php
@@ -509,7 +509,7 @@ class LoginControllerTest extends TestCase {
 			->method('getUID')
 			->willReturn('jane');
 		$password = 'secret';
-		$originalUrl = 'another%20url';
+		$originalUrl = 'another url';
 		$redirectUrl = 'http://localhost/another url';
 
 		$this->request
@@ -551,7 +551,7 @@ class LoginControllerTest extends TestCase {
 			$this->request,
 			$user,
 			$password,
-			'%2Fapps%2Fmail'
+			'/apps/mail'
 		);
 		$loginResult = LoginResult::success($loginData);
 		$this->chain->expects($this->once())
@@ -563,11 +563,11 @@ class LoginControllerTest extends TestCase {
 			->willReturn(true);
 		$this->urlGenerator->expects($this->once())
 			->method('getAbsoluteURL')
-			->with(urldecode('/apps/mail'))
+			->with('/apps/mail')
 			->willReturn($redirectUrl);
 		$expected = new \OCP\AppFramework\Http\RedirectResponse($redirectUrl);
 
-		$response = $this->loginController->tryLogin($user, $password, '%2Fapps%2Fmail');
+		$response = $this->loginController->tryLogin($user, $password, '/apps/mail');
 
 		$this->assertEquals($expected, $response);
 	}