Merge pull request #44745 from nextcloud/fix/auth/2fa-redirect-url

fix(auth): Keep redirect URL during 2FA setup and challenge

3 files changed, 11 insertions, 5 deletions

diff --git a/core/Controller/TwoFactorChallengeController.php b/core/Controller/TwoFactorChallengeController.php
index 7152078c338..48fd365fd12 100644
--- a/core/Controller/TwoFactorChallengeController.php
+++ b/core/Controller/TwoFactorChallengeController.php
@@ -213,13 +213,14 @@ class TwoFactorChallengeController extends Controller {
 	 * @NoCSRFRequired
 	 */
 	#[FrontpageRoute(verb: 'GET', url: 'login/setupchallenge')]
-	public function setupProviders(): StandaloneTemplateResponse {
+	public function setupProviders(?string $redirect_url = null): StandaloneTemplateResponse {
 		$user = $this->userSession->getUser();
 		$setupProviders = $this->twoFactorManager->getLoginSetupProviders($user);
 
 		$data = [
 			'providers' => $setupProviders,
 			'logout_url' => $this->getLogoutUrl(),
+			'redirect_url' => $redirect_url,
 		];
 
 		return new StandaloneTemplateResponse($this->appName, 'twofactorsetupselection', $data, 'guest');
@@ -230,7 +231,7 @@ class TwoFactorChallengeController extends Controller {
 	 * @NoCSRFRequired
 	 */
 	#[FrontpageRoute(verb: 'GET', url: 'login/setupchallenge/{providerId}')]
-	public function setupProvider(string $providerId) {
+	public function setupProvider(string $providerId, ?string $redirect_url = null) {
 		$user = $this->userSession->getUser();
 		$providers = $this->twoFactorManager->getLoginSetupProviders($user);
 
@@ -251,6 +252,7 @@ class TwoFactorChallengeController extends Controller {
 		$data = [
 			'provider' => $provider,
 			'logout_url' => $this->getLogoutUrl(),
+			'redirect_url' => $redirect_url,
 			'template' => $tmpl->fetchPage(),
 		];
 		$response = new StandaloneTemplateResponse($this->appName, 'twofactorsetupchallenge', $data, 'guest');
@@ -264,11 +266,12 @@ class TwoFactorChallengeController extends Controller {
 	 * @todo handle the extreme edge case of an invalid provider ID and redirect to the provider selection page
 	 */
 	#[FrontpageRoute(verb: 'POST', url: 'login/setupchallenge/{providerId}')]
-	public function confirmProviderSetup(string $providerId) {
+	public function confirmProviderSetup(string $providerId, ?string $redirect_url = null) {
 		return new RedirectResponse($this->urlGenerator->linkToRoute(
 			'core.TwoFactorChallenge.showChallenge',
 			[
 				'challengeProviderId' => $providerId,
+				'redirect_url' => $redirect_url,
 			]
 		));
 	}
diff --git a/core/Middleware/TwoFactorMiddleware.php b/core/Middleware/TwoFactorMiddleware.php
index 4b5618eb23d..682df1312d6 100644
--- a/core/Middleware/TwoFactorMiddleware.php
+++ b/core/Middleware/TwoFactorMiddleware.php
@@ -134,8 +134,10 @@ class TwoFactorMiddleware extends Middleware {
 
 	public function afterException($controller, $methodName, Exception $exception) {
 		if ($exception instanceof TwoFactorAuthRequiredException) {
-			$params = [];
-			if (isset($this->request->server['REQUEST_URI'])) {
+			$params = [
+				'redirect_url' => $this->request->getParam('redirect_url'),
+			];
+			if (!isset($params['redirect_url']) && isset($this->request->server['REQUEST_URI'])) {
 				$params['redirect_url'] = $this->request->server['REQUEST_URI'];
 			}
 			return new RedirectResponse($this->urlGenerator->linkToRoute('core.TwoFactorChallenge.selectChallenge', $params));
diff --git a/core/templates/twofactorsetupselection.php b/core/templates/twofactorsetupselection.php
index 4ef19d86349..fb8db49cf17 100644
--- a/core/templates/twofactorsetupselection.php
+++ b/core/templates/twofactorsetupselection.php
@@ -33,6 +33,7 @@ declare(strict_types=1);
 			   href="<?php p(\OC::$server->getURLGenerator()->linkToRoute('core.TwoFactorChallenge.setupProvider',
 			   	[
 			   		'providerId' => $provider->getId(),
+			   		'redirect_url' => $_['redirect_url'],
 			   	]
 			   )) ?>">
 				<?php