Thread review Url through login button (#343)

* Thread review Url through login button * Add ReturnUrl property
Azure · Jan 21, 2020 · 2aaf7d1 · 2aaf7d1
1 parent 1b0e8ce
commit 2aaf7d1
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 1 deletion.
diff --git a/src/dotnet/APIView/APIViewWeb/Controllers/AccountController.cs b/src/dotnet/APIView/APIViewWeb/Controllers/AccountController.cs
@@ -12,6 +12,10 @@ public class AccountController : Controller
         public async Task<IActionResult> Login(string returnUrl = "/")
         {
             await HttpContext.SignOutAsync();
+            if (!Url.IsLocalUrl(returnUrl))
+            {
+                returnUrl = "/";
+            }
             return Challenge(new AuthenticationProperties() { RedirectUri = returnUrl }, "GitHub");
         }
 

diff --git a/src/dotnet/APIView/APIViewWeb/Pages/Unauthorized.cshtml b/src/dotnet/APIView/APIViewWeb/Pages/Unauthorized.cshtml
@@ -24,7 +24,7 @@
     find yourself under the "People" tab of the organization page and set your visibility to public.
 </p>
 
-<a class="login-button btn btn-outline-dark" asp-action="Login" asp-controller="Account">
+<a class="login-button btn btn-outline-dark" asp-action="Login" asp-controller="Account" asp-route-returnUrl="@Model.ReturnUrl">
     <img height="30" width="30" src="https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png" />
     Login with GitHub
 </a>
diff --git a/src/dotnet/APIView/APIViewWeb/Pages/Unauthorized.cshtml.cs b/src/dotnet/APIView/APIViewWeb/Pages/Unauthorized.cshtml.cs
@@ -9,6 +9,9 @@ public class UnauthorizedModel : PageModel
     {
         public OrganizationOptions Options { get; }
 
+        [BindProperty(SupportsGet = true)]
+        public string ReturnUrl { get; private set; }
+
         public UnauthorizedModel(IOptions<OrganizationOptions> options)
         {
             Options = options.Value;
@@ -17,7 +20,10 @@ public UnauthorizedModel(IOptions<OrganizationOptions> options)
         public IActionResult OnGet()
         {
             if (User.Identity.IsAuthenticated)
+            {
                 return RedirectToPage("./Assemblies/Index");
+            }
+            ReturnUrl = Request.Query["returnurl"];
             return Page();
         }
     }