diff --git a/core/Controller/LoginController.php b/core/Controller/LoginController.php index 40e13b43c80f0..b765e448888e2 100644 --- a/core/Controller/LoginController.php +++ b/core/Controller/LoginController.php @@ -251,7 +251,7 @@ private function setPasswordResetParameters( */ private function generateRedirect($redirectUrl) { if (!is_null($redirectUrl) && $this->userSession->isLoggedIn()) { - $location = $this->urlGenerator->getAbsoluteURL(urldecode($redirectUrl)); + $location = $this->urlGenerator->getAbsoluteURL($redirectUrl); // Deny the redirect if the URL contains a @ // This prevents unvalidated redirects like ?redirect_url=:user@domain.com if (strpos($location, '@') === false) {