fs
e1c211069e
Session timeout redirected to /de/login?return_to=... but the remember-me cookie was not cleared by logoutDueToSessionTimeout(). On the next request, autoLoginFromCookie() silently re-logged the user in, causing the MintyPHP router to resolve the login route to pages/index().php (dashboard) instead of the login action — the intended URL redirect logic never executed. Fix: intercept ?return_to= immediately after successful auto-login in index.php and redirect to the sanitized route path. Also harden the login flow with hidden return_to form fields and POST body fallback for cases without remember-me. Additional improvements in this commit: - Convert stored REQUEST_URI to router-compatible path (strip leading slash and locale prefix) via IntendedUrlService::toRoutePath() - Consolidate duplicate CSRF data attributes into shared data-csrf-key and data-csrf-token on <html> element - Add tenant branding (logo) to auth pages via appAuthLogoUrl() helper Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
18 lines
573 B
PHTML
18 lines
573 B
PHTML
<?php
|
|
|
|
$authLogoUrl = appAuthLogoUrl();
|
|
if ($authLogoUrl === '') {
|
|
return;
|
|
}
|
|
$authLogoHref = isset($authLogoHref) && is_string($authLogoHref) ? trim($authLogoHref) : '';
|
|
?>
|
|
<div class="login-logo">
|
|
<?php if ($authLogoHref !== ''): ?>
|
|
<a href="<?php e($authLogoHref); ?>" class="login-logo-link">
|
|
<img src="<?php e($authLogoUrl); ?>" alt="<?php e(appTitle()); ?>" class="login-logo-img">
|
|
</a>
|
|
<?php else: ?>
|
|
<img src="<?php e($authLogoUrl); ?>" alt="<?php e(appTitle()); ?>" class="login-logo-img">
|
|
<?php endif; ?>
|
|
</div>
|