-
-
Notifications
You must be signed in to change notification settings - Fork 4.7k
Do not do redirect handling when loggin out #12573
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
I dislike this patch a bit, because if you are on a page which is publicly accessible, it loads that page, instead of redirecting to the login form. In my head the following should have worked: public function showLoginForm(string $user = null, string $redirect_url = null): Http\Response {
if ($this->session->exists('clearingExecutionContexts')) {
$this->session->remove('clearingExecutionContexts');
$response = new RedirectResponse($this->urlGenerator->linkToRouteAbsolute('core.login.showLoginForm'));
$response->addHeader('Clear-Site-Data', '"cache", "storage", "executionContexts"');
return $response;
}But while your request is on |
|
Do you have a logout button on a public page? |
|
Well on Talk the same URL is used for a room independent of your login state. |
|
@rullzer @nickvergessen What is the status here? Continue it or close it? |
|
Let me have another look. I might have a more elegant way |
|
@nickvergessen can you verify that this seems fixed with the latest firefox? |
|
No, it is still the same with ff 65. |
|
Same here, still broken with FF 65.0 |
9e1061d to
689adc8
Compare
|
Ok this is now a bit more elegant I think. @nickvergessen please check it out |
lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php
Outdated
Show resolved
Hide resolved
Fixes #12568 Since the clearing of the execution context causes another reload. We should not do the redirect_uri handling as this results in redirecting back to the logout page on login. This adds a simple middleware that will just check if the ClearExecutionContext session variable is set. If that is the case it will just redirect back to the login page. Signed-off-by: Roeland Jago Douma <[email protected]>
689adc8 to
60e5a5e
Compare
nickvergessen
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That works perfectly.
MorrisJobke
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Tested and works 👍
|
Backport? |
|
Fine by me. It is mainly an added middleware. So should not cause issues. |
|
/backport to stable15 |
|
The backport to stable15 failed. Please do this backport manually. |
See https://github.com/nextcloud/server/blob/b085803c0bfe8c568e5710525e49d5f6378833b6/core/Controller/LoginController.php#L99 and following lines. Also note that setting `clearingExecutionContexts` is no longer required, because it had to do with the executionContexts feature which is no longer used by nextcloud since nextcloud/server#16310. Furthermore, with the behavior introduced in nextcloud/server#12573, setting `clearingExecutionContexts` breaks our logout redirects, because the middleware subsequently (after the logout redirect) returns another redirects to `/login?clear=1`.
See https://github.com/nextcloud/server/blob/b085803c0bfe8c568e5710525e49d5f6378833b6/core/Controller/LoginController.php#L99 and following lines. Also note that setting `clearingExecutionContexts` is no longer required, because it had to do with the executionContexts feature which is no longer used by nextcloud since nextcloud/server#16310. Furthermore, with the behavior introduced in nextcloud/server#12573, setting `clearingExecutionContexts` breaks our logout redirects, because the middleware subsequently (after the logout redirect) returns another redirects to `/login?clear=1`.
Fixes #12568
Since the clearing of the execution context causes another reload. We
should not do the redirect_uri handling as this results in redirecting
back to the logout page on login.
Signed-off-by: Roeland Jago Douma [email protected]