From af0c032bf72b4e38d1b7de44e163ee9d69f3dee5 Mon Sep 17 00:00:00 2001 From: IanM Date: Thu, 4 Jan 2024 21:03:44 +0000 Subject: [PATCH] cast url as string, reinstate guest redirect --- framework/core/src/Forum/Controller/LogOutController.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/framework/core/src/Forum/Controller/LogOutController.php b/framework/core/src/Forum/Controller/LogOutController.php index fde933fda5..8c28b308db 100644 --- a/framework/core/src/Forum/Controller/LogOutController.php +++ b/framework/core/src/Forum/Controller/LogOutController.php @@ -92,11 +92,11 @@ public function handle(Request $request): ResponseInterface $actor = RequestUtil::getActor($request); $base = $this->url->to('forum')->base(); - $url = Arr::get($request->getQueryParams(), 'return', $base); + $sanitizedUrl = $this->sanitizeReturnUrl((string) Arr::get($request->getQueryParams(), 'return', $base)); // If there is no user logged in, return to the index. if ($actor->isGuest()) { - return new RedirectResponse($base); + return new RedirectResponse(empty($sanitizedUrl) ? $base : $sanitizedUrl); } // If a valid CSRF token hasn't been provided, show a view which will @@ -113,7 +113,7 @@ public function handle(Request $request): ResponseInterface } $accessToken = $session->get('access_token'); - $response = new RedirectResponse($url); + $response = new RedirectResponse($sanitizedUrl); $this->authenticator->logOut($session);