From dd912169fbd3e43ee308af22edcfae73d44c697e Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Sat, 11 Mar 2023 10:05:11 +0100
Subject: [PATCH] Make the login page guess where to redirect

---
 core/admin/mailu/sso/views/base.py | 23 +++++++++++++++++------
 core/admin/mailu/utils.py          |  3 ++-
 core/nginx/conf/nginx.conf         |  2 +-
 towncrier/newsfragments/2692.misc  |  2 +-
 4 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/core/admin/mailu/sso/views/base.py b/core/admin/mailu/sso/views/base.py
index 0375117b..ff710add 100644
--- a/core/admin/mailu/sso/views/base.py
+++ b/core/admin/mailu/sso/views/base.py
@@ -8,19 +8,25 @@ import flask
 import flask_login
 import secrets
 import ipaddress
+from urllib.parse import urlparse, urljoin
+from werkzeug.urls import url_unquote
 
 @sso.route('/login', methods=['GET', 'POST'])
 def login():
     client_ip = flask.request.headers.get('X-Real-IP', flask.request.remote_addr)
     form = forms.LoginForm()
-    form.submitAdmin.label.text = form.submitAdmin.label.text + ' Admin'
-    form.submitWebmail.label.text = form.submitWebmail.label.text + ' Webmail'
 
     fields = []
-    if str(app.config["WEBMAIL"]).upper() != "NONE":
-        fields.append(form.submitWebmail)
-    if str(app.config["ADMIN"]).upper() != "FALSE":
+
+    if flask.request.args.get('url'):
         fields.append(form.submitAdmin)
+    else:
+        form.submitAdmin.label.text = form.submitAdmin.label.text + ' Admin'
+        form.submitWebmail.label.text = form.submitWebmail.label.text + ' Webmail'
+        if str(app.config["WEBMAIL"]).upper() != "NONE":
+            fields.append(form.submitWebmail)
+        if str(app.config["ADMIN"]).upper() != "FALSE":
+            fields.append(form.submitAdmin)
     fields = [fields]
 
     if form.validate_on_submit():
@@ -28,6 +34,11 @@ def login():
             destination = app.config['WEB_ADMIN']
         elif form.submitWebmail.data:
             destination = app.config['WEB_WEBMAIL']
+        if url := flask.request.args.get('url'):
+            url = url_unquote(url)
+            target = urlparse(urljoin(flask.request.url, url))
+            if target.netloc == urlparse(flask.request.url).netloc:
+                destination = target.geturl()
         device_cookie, device_cookie_username = utils.limiter.parse_device_cookie(flask.request.cookies.get('rate_limit'))
         username = form.email.data
         if username != device_cookie_username and utils.limiter.should_rate_limit_ip(client_ip):
@@ -57,7 +68,7 @@ def login():
 def logout():
     flask_login.logout_user()
     flask.session.destroy()
-    response = flask.redirect(app.config('PROXY_AUTH_LOGOUT_URL') or flask.url_for('.login'))
+    response = flask.redirect(app.config['PROXY_AUTH_LOGOUT_URL'] or flask.url_for('.login'))
     for cookie in ['roundcube_sessauth', 'roundcube_sessid', 'smsession']:
         response.set_cookie(cookie, 'empty', expires=0)
     return response
diff --git a/core/admin/mailu/utils.py b/core/admin/mailu/utils.py
index b432192d..bbf0a829 100644
--- a/core/admin/mailu/utils.py
+++ b/core/admin/mailu/utils.py
@@ -33,6 +33,7 @@ from flask.sessions import SessionMixin, SessionInterface
 from itsdangerous.encoding import want_bytes
 from werkzeug.datastructures import CallbackDict
 from werkzeug.middleware.proxy_fix import ProxyFix
+from werkzeug.urls import url_quote
 
 # Login configuration
 login = flask_login.LoginManager()
@@ -42,7 +43,7 @@ login.login_view = "sso.login"
 def handle_needs_login():
     """ redirect unauthorized requests to login page """
     return flask.redirect(
-        flask.url_for('sso.login')
+        flask.url_for('sso.login')+f'?url={url_quote(flask.request.url)}'
     )
 
 # DNS stub configured to do DNSSEC enabled queries
diff --git a/core/nginx/conf/nginx.conf b/core/nginx/conf/nginx.conf
index 89eeb4bf..3c7dbc35 100644
--- a/core/nginx/conf/nginx.conf
+++ b/core/nginx/conf/nginx.conf
@@ -216,7 +216,7 @@ http {
       }
 
       location @webmail_login {
-        return 302 /sso/login;
+        return 302 /sso/login?url=$request_uri;
       }
       {% endif %}
       {% if ADMIN %}
diff --git a/towncrier/newsfragments/2692.misc b/towncrier/newsfragments/2692.misc
index 4d2937a7..c8f6f8fc 100644
--- a/towncrier/newsfragments/2692.misc
+++ b/towncrier/newsfragments/2692.misc
@@ -1,2 +1,2 @@
-Make the login page "guess" where the user wants to land using the Referer header
+Make the login page "guess" where the user wants to land
 Introduce AUTH_PROXY_LOGOUT_URL to redirect users to a specific URL after they have been logged-out