Fix #2288 allow redirect after logout, only if the target URL is internal

This commit is contained in:
Kijin Sung 2024-01-30 21:37:43 +09:00
parent a36d728ad9
commit 00db22abdb
2 changed files with 21 additions and 5 deletions

View file

@ -134,11 +134,20 @@ class MemberController extends Member
// If a device key is present, unregister it.
Rhymix\Modules\Member\Controllers\Device::getInstance()->autoUnregisterDevice($logged_info->member_srl);
// Set redirect URL.
$output = new BaseObject();
$config = ModuleModel::getModuleConfig('member');
if($config->after_logout_url)
$redirect_url = Context::get('redirect_url');
if ($redirect_url && Rhymix\Framework\URL::isInternalURL($redirect_url))
{
$output->redirect_url = $config->after_logout_url;
$output->redirect_url = $redirect_url;
}
else
{
$config = ModuleModel::getModuleConfig('member');
if($config->after_logout_url)
{
$output->redirect_url = $config->after_logout_url;
}
}
return $output;
}