Skip to content

Commit 1a8dd94

Browse files
jasonvargaclaude
jasonvarga
and
claude
authored
[6.x] Fix login redirects (#14560)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent 994cb74 commit 1a8dd94

25 files changed

Lines changed: 126 additions & 230 deletions

‎resources/js/components/global-header/UserDropdown.vue‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import { Avatar, Button, DropdownHeader, Badge, Dropdown, DropdownMenu, Dropdown
44
import useStatamicPageProps from '@/composables/page-props.js';
55
66
const { supportUrl } = useStatamicPageProps();
7-
const logoutUrl = `${cp_url('auth/logout')}?redirect=${cp_url('/')}`;
7+
const logoutUrl = `${cp_url('auth/logout')}?redirect=${cp_url('auth/login')}`;
88
const user = Statamic.user;
99
const isImpersonating = computed((() => user.is_impersonating));
1010
</script>

‎resources/js/pages/auth/Login.vue‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ const props = defineProps([
1515
'passkeyVerifyUrl',
1616
'oauthEnabled',
1717
'providers',
18-
'referer',
1918
'submitUrl',
2019
'forgotPasswordUrl',
2120
])
@@ -42,11 +41,11 @@ const submit = () => {
4241
errors.value = {};
4342
},
4443
onSuccess: (page) => {
45-
if (page.component === 'auth/two-factor/Challenge') {
46-
return;
47-
}
44+
if (page.component === 'auth/two-factor/Challenge') {
45+
return;
46+
}
4847
49-
window.location.href = props.referer;
48+
window.location.href = page.url;
5049
},
5150
onError: () => processing.value = false
5251
});

‎resources/js/pages/auth/Unauthorized.vue‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
import Head from '@/pages/layout/Head.vue';
33
import Outside from '@/pages/layout/Outside.vue';
44
import { AuthCard, Button } from '@ui';
5-
import { Link } from '@inertiajs/vue3';
65
76
defineOptions({ layout: Outside });
87
@@ -19,7 +18,7 @@ defineProps(['isLoggedIn', 'loginUrl', 'logoutUrl']);
1918
>
2019
<div class="flex justify-center">
2120
<Button
22-
:as="Link"
21+
as="a"
2322
variant="primary"
2423
:href="isLoggedIn ? logoutUrl : loginUrl"
2524
class="w-full"

‎src/Exceptions/AuthenticationException.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,6 @@ protected function handleRedirect()
2222
: abort(401);
2323
}
2424

25-
return redirect()->route('statamic.cp.login');
25+
return redirect()->guest(route('statamic.cp.login'));
2626
}
2727
}

‎src/Http/Controllers/CP/Auth/LoginController.php‎

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
use Statamic\Http\Middleware\CP\RedirectIfAuthorized;
1616
use Statamic\OAuth\Provider;
1717
use Statamic\Statamic;
18-
use Statamic\Support\Str;
1918

2019
use function Statamic\trans as __;
2120

@@ -43,7 +42,6 @@ public function showLoginForm(Request $request)
4342
'oauthEnabled' => $oauthEnabled,
4443
'emailLoginEnabled' => $emailLoginEnabled,
4544
'providers' => $oauthEnabled ? $this->oauthProviders() : [],
46-
'referer' => $this->getReferrer($request),
4745
'forgotPasswordUrl' => cp_route('password.request'),
4846
'submitUrl' => cp_route('login'),
4947
'passkeyOptionsUrl' => cp_route('passkeys.auth.options'),
@@ -107,11 +105,7 @@ protected function fireFailedEvent($request, $user = null)
107105

108106
public function redirectPath()
109107
{
110-
$cp = cp_route('index');
111-
$referer = request('referer');
112-
$referredFromCp = Str::startsWith($referer, $cp) && ! Str::startsWith($referer, $cp.'/auth/');
113-
114-
return $referredFromCp ? $referer : $cp;
108+
return cp_route('index');
115109
}
116110

117111
protected function authenticated(Request $request, $user)
@@ -144,13 +138,6 @@ public function logout(Request $request)
144138
return redirect(URL::isExternalToApplication($redirect) ? '/' : $redirect);
145139
}
146140

147-
protected function getReferrer()
148-
{
149-
$referrer = url()->previous();
150-
151-
return $referrer === cp_route('unauthorized') ? cp_route('index') : $referrer;
152-
}
153-
154141
public function username()
155142
{
156143
return 'email';

‎src/Http/Controllers/CP/Auth/PasskeyLoginController.php‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,12 @@
22

33
namespace Statamic\Http\Controllers\CP\Auth;
44

5-
use Illuminate\Http\Request;
6-
use Statamic\Facades\URL;
75
use Statamic\Http\Controllers\User\PasskeyLoginController as Controller;
8-
use Statamic\Support\Str;
96

107
class PasskeyLoginController extends Controller
118
{
12-
protected function successRedirectUrl(Request $request): string
9+
protected function defaultRedirectUrl(): string
1310
{
14-
$referer = $request->input('referer');
15-
16-
return Str::contains($referer, '/'.config('statamic.cp.route')) && ! URL::isExternalToApplication($referer)
17-
? $referer
18-
: cp_route('index');
11+
return cp_route('index');
1912
}
2013
}

‎src/Http/Controllers/CP/Auth/TwoFactorChallengeController.php‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,9 @@
22

33
namespace Statamic\Http\Controllers\CP\Auth;
44

5-
use Illuminate\Http\Request;
65
use Statamic\Http\Controllers\TwoFactorChallengeController as Controller;
76
use Statamic\Http\Middleware\CP\HandleInertiaRequests;
87
use Statamic\Http\Middleware\CP\RedirectIfAuthorized;
9-
use Statamic\Support\Str;
108

119
class TwoFactorChallengeController extends Controller
1210
{
@@ -22,13 +20,9 @@ protected function formAction()
2220
return cp_route('two-factor-challenge');
2321
}
2422

25-
protected function redirectPath(Request $request)
23+
protected function defaultRedirectPath(): string
2624
{
27-
$cp = cp_route('index');
28-
$referer = $request->input('referer');
29-
$referredFromCp = Str::startsWith($referer, $cp) && ! Str::startsWith($referer, $cp.'/auth/');
30-
31-
return $referredFromCp ? $referer : $cp;
25+
return cp_route('index');
3226
}
3327

3428
protected function failedRedirectPath()

‎src/Http/Controllers/CP/Auth/TwoFactorSetupController.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,10 @@ public function __construct(Request $request)
1616
protected function redirectPath()
1717
{
1818
$cp = cp_route('index');
19-
$referer = request('referer');
20-
$referredFromCp = Str::startsWith($referer, $cp) && ! Str::startsWith($referer, $cp.'/auth/');
19+
$intended = redirect()->getIntendedUrl();
20+
$isCpUrl = $intended && Str::startsWith($intended, $cp) && ! Str::startsWith($intended, $cp.'/auth/');
2121

22-
return $referredFromCp ? $referer : $cp;
22+
return $isCpUrl ? $intended : $cp;
2323
}
2424

2525
protected function routes($user): array

‎src/Http/Controllers/Concerns/HandlesLogins.php‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -60,21 +60,15 @@ protected function throwFailedAuthenticationException(Request $request)
6060

6161
protected function twoFactorChallengeResponse(Request $request, User $user)
6262
{
63-
$request->session()->forget('login.redirect');
64-
65-
$session = [
63+
$request->session()->put([
6664
'login.id' => $user->getKey(),
6765
'login.remember' => $request->boolean('remember'),
68-
];
66+
]);
6967

70-
if ($redirect = $request->input('_redirect')) {
71-
if (! URL::isExternalToApplication($redirect)) {
72-
$session['login.redirect'] = $redirect;
73-
}
68+
if (($redirect = $request->input('_redirect')) && ! URL::isExternalToApplication($redirect)) {
69+
redirect()->setIntendedUrl($redirect);
7470
}
7571

76-
$request->session()->put($session);
77-
7872
TwoFactorAuthenticationChallenged::dispatch($user);
7973

8074
return $request->wantsJson()

‎src/Http/Controllers/TwoFactorChallengeController.php‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -58,13 +58,15 @@ public function store(TwoFactorChallengeRequest $request)
5858

5959
$request->session()->regenerate();
6060

61+
$redirect = $this->redirectPath($request);
62+
6163
if ($request->inertia() || $request->expectsJson()) {
6264
return $request->inertia()
63-
? Inertia::location($this->redirectPath($request))
65+
? Inertia::location($redirect)
6466
: response('Authenticated');
6567
}
6668

67-
return redirect()->intended($this->redirectPath($request));
69+
return redirect($redirect);
6870
}
6971

7072
protected function sendFailedResponse(TwoFactorChallengeRequest $request)
@@ -85,18 +87,17 @@ protected function formAction()
8587

8688
protected function redirectPath(Request $request)
8789
{
88-
if ($redirect = $request->input('_redirect')) {
89-
if (! URL::isExternalToApplication($redirect)) {
90-
return $redirect;
91-
}
92-
}
90+
$intended = $request->session()->pull('url.intended', $this->defaultRedirectPath());
9391

94-
if ($redirect = $request->session()->pull('login.redirect')) {
95-
if (! URL::isExternalToApplication($redirect)) {
96-
return $redirect;
97-
}
92+
if (($redirect = $request->input('_redirect')) && ! URL::isExternalToApplication($redirect)) {
93+
return $redirect;
9894
}
9995

96+
return $intended;
97+
}
98+
99+
protected function defaultRedirectPath(): string
100+
{
100101
return route('statamic.site');
101102
}
102103

0 commit comments

Comments
 (0)