Improved: previous request information lost at login#1479
Open
nmalin wants to merge 3 commits into
Open
Conversation
Currently, when you arrived on OFBiz after the login page you're redirected to default request even though you have specified a URI. Try to log on https://localhost:8443/webtools/control/entity/find/Party, you are redirect to login page and after login OFBiz return on page https://localhost:8443/webtools/control/main This come from issue OFBIZ-12047 (d60bf15, 33fe2aa) where we remove the previous request on 'login' uri to be sure to clean it. We reversed the logic, set previous request only when checkLogin control a request that need an authentification and isn't a ajax call or login (or related) url
Contributor
|
Hi @nmalin |
Contributor
Author
|
Hello @jacopoc, Yes, I agree. I try to find the good way on this spaghetti mix. I exposed my advancement on it and like you spot it, it's not enough. I would like to secure the PREVIOUS_REQUEST attribute at the beginning for that, but as it's a sensible area, I clearly wait for your (or some other) approval. I needed to move forward on other things, but sure, I'll look into it to solve that. |
- tried to sanitize before send pathInfo on log or user. - don't store previous request if the request is linked to an event
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently, when you arrive on OFBiz after the login page, you're redirected to the default request even though you have specified a URI.
Try to log on to https://localhost:8443/webtools/control/entity/find/Party, you are redirected to the login page, and after login, OFBiz returns to the page https://localhost:8443/webtools/control/main instead of the asked URI: entity/find/Party
This comes from issue OFBIZ-12047 (d60bf15, 33fe2aa) where we remove the previous request on the 'login' URI to be sure to clean it.
We reversed the logic, and set the previous request only when checkLogin controls a request that needs authentication and isn't an AJAX call or login (or related) URL.