diff --git a/modoboa/core/views/auth.py b/modoboa/core/views/auth.py index d8e87f96a..2ca28c56a 100644 --- a/modoboa/core/views/auth.py +++ b/modoboa/core/views/auth.py @@ -57,11 +57,11 @@ def dologin(request): "user": form.cleaned_data["username"]} ) - nextlocation = request.POST.get("next", None) + nextlocation = request.POST.get("next", "") httpcode = 401 else: form = forms.LoginForm() - nextlocation = request.GET.get("next", None) + nextlocation = request.GET.get("next", "") httpcode = 200 announcements = signals.get_announcements.send( @@ -75,6 +75,7 @@ def dologin(request): request), status=httpcode) + dologin = never_cache(dologin) diff --git a/modoboa/core/views/base.py b/modoboa/core/views/base.py index 69b798179..8d4634bf3 100644 --- a/modoboa/core/views/base.py +++ b/modoboa/core/views/base.py @@ -18,7 +18,7 @@ def find_nextlocation(request, user): return reverse("core:user_index") nextlocation = request.POST.get("next", request.GET.get("next")) condition = ( - nextlocation is not None and nextlocation != "" and nextlocation != "None" and + nextlocation and is_safe_url(nextlocation, host=request.get_host()) ) if condition: