Merge pull request #499 from edx/diana/login-redirect

Only redirect when redirect url is an internal page.

cms/djangoapps/contentstore/features/signup.feature

@@ -10,3 +10,20 @@ Feature: Sign in
     And I press the Create My Account button on the registration form
     Then I should see be on the studio home page
     And I should see the message "complete your sign up we need you to verify your email address"
+
+  Scenario: Login with a valid redirect
+    Given I have opened a new course in Studio
+    And I am not logged in
+    And I visit the url "/MITx/999/course/Robot_Super_Course"
+    And I should see that the path is "/signin?next=/MITx/999/course/Robot_Super_Course"
+    When I fill in and submit the signin form
+    And I wait for "2" seconds
+    Then I should see that the path is "/MITx/999/course/Robot_Super_Course"
+
+  Scenario: Login with an invalid redirect
+    Given I have opened a new course in Studio
+    And I am not logged in
+    And I visit the url "/signin?next=http://www.google.com/"
+    When I fill in and submit the signin form
+    And I wait for "2" seconds
+    Then I should see that the path is "/"

cms/djangoapps/contentstore/features/signup.py

@@ -30,3 +30,13 @@ def i_should_see_be_on_the_studio_home_page(step):
 @step(u'I should see the message "([^"]*)"$')
 def i_should_see_the_message(step, msg):
     assert world.browser.is_text_present(msg, 5)
+
+
+@step(u'I fill in and submit the signin form$')
+def i_fill_in_the_signin_form(step):
+    def fill_login_form():
+        login_form = world.browser.find_by_css('form#login_form')
+        login_form.find_by_name('email').fill('robot+studio@edx.org')
+        login_form.find_by_name('password').fill('test')
+        login_form.find_by_name('submit').click()
+    world.retry_on_exception(fill_login_form)

cms/envs/common.py

@@ -247,7 +247,7 @@ PIPELINE_JS = {
              'js/models/section.js', 'js/views/section.js',
              'js/models/metadata_model.js', 'js/views/metadata_editor_view.js',
              'js/models/textbook.js', 'js/views/textbook.js',
-             'js/views/assets.js'],
+             'js/views/assets.js', 'js/utility.js'],
         'output_filename': 'js/cms-application.js',
         'test_order': 0
     },

cms/templates/login.html

@@ -79,7 +79,7 @@
       function(json) {
         if(json.success) {
           var next = /next=([^&]*)/g.exec(decodeURIComponent(window.location.search));
-          if (next && next.length > 1) {
+          if (next && next.length > 1 && !isExternal(next[1])) {
             location.href = next[1];
           }
           else location.href = "${reverse('homepage')}";