Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes #369 — Fixes permission denied redirects #400

Merged
merged 1 commit into from
Jul 12, 2016
Merged

Conversation

oliverroick
Copy link
Member

The following case leads to a redirect loop:

  • The user is not authenticated.
  • The user tries to access a page that requires authentication.
  • The server redirects to the login page.
  • The user authenticates themselves and is redirected to the original page.
  • The user does have the required permissions on the original page and is redirected to the referrer, in this case the login page.
  • Because the user is now authenticated, the login page again redirects to the original page. The redirect loop is entered.

This PR solves this issue by checking if the referrer is the login page and if a user is authenticated. The redirect as adapted based on the page the user tried to access:

  • If the page is below the project dashboard level, the redirect points to the project dashboard.
  • If the page is the project dashboard, the redirect points to the organisation dashboard.
  • If the page is below the organisation dashboard level, the redirect points to the organisation dashboard.
  • If the page is the organisation dashboard, the redirect points to the platform dashboard.

If the referrer is not the login page, the server will redirect to the referrer.

@ian-ross ian-ross merged commit d3e1d82 into master Jul 12, 2016
@ian-ross ian-ross deleted the bugfix/#369 branch July 12, 2016 12:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants