Plugin/Auth/Extensible.pm _default_login_page will call uri_escape() multiple times for return_url
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 42/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- perl
- Domain
- authentication, backend
Research direction
Start in Plugin/Auth/Extensible.pm at _default_login_page and reproduce the flow by visiting a role-protected route, submitting incorrect credentials, and inspecting the hidden return_url value. Done means repeated visits to /login do not repeatedly escape the URL and a successful login returns to the original route.
Written by the indexing model from the issue text.
Description
Granted almost everyone will replace the default login page, this bug is disconcerting when starting to learn authentication and session management for Dancer2.
Once a route is added requiring a role, the user is referred to /login. If an incorrect name/password combination is given the user is referred back to /login agin but uri_escape() is called on request_url again, breaking it in the hidden field although it still looks OK in the browser location bar.
/login, first time: <input type="hidden" name="return_url" value="%2Freport">
/login, second time: <input type="hidden" name="return_url" value="%252Freport">
I'm not nearly sure what the fix should be. Trusting user input? Ah, no. But blindly escaping things twice causes problems too, as when the user supplies a correct username and password they are no longer routed back to the route they started with.
Edit: use sufficient HTML markup to see all the problem report.
- Dominant language
- Perl
- Stars
- 604
- Forks
- 290
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 3
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PerlDancer/Dancer2
-
Add .gitattributes so share/skel keeps LF on a Windows git checkoutPossibly taken @sadhana-s-codez claimed this 11 days ago. Open
Difficulty 1/5 Under an hour Newbie friendliness 85/100
PerlDancer/Dancer2#1854 · 1 comment ·
Maintainers usually reply within 2 days
-
dancer2 gen -c writes the Dockerfile outside the app directoryMay be free again A pull request for this issue was closed without being merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
PerlDancer/Dancer2#1851 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
PerlDancer/Dancer2#1850 ·
Maintainers usually reply within 2 days
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
PerlDancer/Dancer2#1820 ·
Maintainers usually reply within 2 days
-
Enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
PerlDancer/Dancer2#1819 ·
Maintainers usually reply within 2 days
All issues in PerlDancer/Dancer2
Similar issues
-
FIDO2 (ecdsa-sk / ed25519-sk) ingress keys rejected: missing in get_supported_ssh_algorithms_listOpen
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
ovh/the-bastion#695 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
observablt-ci
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
elastic/golang-crossbuild#840 ·
Maintainers usually reply within 1 day
-
Sync playback crashes repeatedly in a sync group (v9.1.1)Possibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
LMS-Community/slimserver#1701 · 6 comments ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
RotherOSS/otobo#6286 · 1 comment ·
Maintainers usually reply within 1 day