Skip to content
Snippets Groups Projects
Commit e94ea80c authored by Demian Katz's avatar Demian Katz
Browse files

More targeted parameter stripping.

- Resolves VUFIND-1020.
parent d7e4dad7
No related merge requests found
......@@ -248,8 +248,14 @@ class MyResearchController extends AbstractBase
$logoutTarget = $this->getServerUrl('home');
}
// clear querystring parameters
$logoutTarget = preg_replace('/\?.*/', '', $logoutTarget);
// If there is an auth_method parameter in the query, we should strip
// it out. Otherwise, the user may get stuck in an infinite loop of
// logging out and getting logged back in when using environment-based
// authentication methods like Shibboleth.
$logoutTarget = preg_replace(
'/([?&])auth_method=[^&]*&?/', '$1', $logoutTarget
);
$logoutTarget = rtrim($logoutTarget, '?');
}
return $this->redirect()
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment