Use referer URL to redirect after password update

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.1.1 CE GA2, 6.1.20 EE GA2
• Fix Version/s: 6.1.30 EE GA3, 6.2.0 CE M2
• Component/s: Util, Util > Login portlet
• Labels: None
• Branch Version/s:
  6.1.x
• Backported to Branch:
  Committed
• Epic/Theme:
  • social_office
• Similar Issues: Show 4 results ; ;

  LPS-34334	Update Password page can have it's own URL as a referer to redirect after form post
  LPS-10578	URL Redirection to Untrusted Site
  LPS-406	More robust manipulation of redirect URLs
  LPS-39228	Unable to update password/organization/etc fields of users using firefox

Steps to reproduce:

1. Start a blank Liferay installation
2. Without signing in, navigate to the following url (assuming your Liferay server is running at localhost and port 8080):

http://localhost:8080/web/guest/home?p_p_id=36&p_p_lifecycle=0&p_p_state=maximized&p_p_mode=view

You should see the Wiki portlet maximized in the home page.

3. Now navigate to this url:

http://localhost:8080/web/guest/home?p_p_id=58&p_p_lifecycle=0&p_p_state=maximized&p_p_mode=view&p_p_col_id=column-1&p_p_col_count=1&saveLastPath=0&_58_struts_action=%2Flogin%2Fcreate_account&redirect=http%3A%2F%2Flocalhost%3A8080%2Fweb%2Fguest%2Fhome%3Fp_p_id%3D36%26p_p_lifecycle%3D0%26p_p_state%3Dmaximized%26p_p_mode%3Dview

You should see the create account form.

4. Go through all the create account process, including writing a new password.

After the process you should get redirected to the same view as in 2 (the home page displaying the Wiki portlet maximized). Instead, though you get to the same page, the wiki portlet is not displayed.

During the create account process, after updating their password, users might get redirected to a view different from the one they're coming from.

The UpdatePasswordAction is not using the original URL contained in the referer param for the redirection after updating the password. In case referer URL exists, it should be used for the redirection so that users remain in the original page.

[Brian Chan]

See https://github.com/brianchandotcom/liferay-portal/pull/7482

[Michael Saechang]

Committed on:
Portal 6.2.x GIT ID: 127ccd79d4cd11259ad8aa38da4e8a1c383ed016.

[Benjamin Yeh (Inactive)]

Passed Manual Testing following steps in description:

Fixed On:
Tomcat 7.0.27 + MySQL 5.5. 6.1.X GIT ID: 93cc5925d9b6d046d63880a11f0ea3ea83e3d916.

After creating the new user account it's redirected to the previously view page.

[Edward Gonzales]

Hello! We plan to remove "Authentication" from the component field from issues that have more than 1 component. This issue has been identified as a candidate. It is recommended that you update any affected filters. Thanks!