Merge pull request #19453 from edx/arch/cleanup-login

Studio login/registration redirects to LMS

openedx/core/djangoapps/site_configuration/context_processors.py

@@ -3,6 +3,7 @@ Django template context processors.
 """
 
 from django.conf import settings
+from django.utils.http import urlquote_plus
 
 from openedx.core.djangoapps.site_configuration import helpers as configuration_helpers
 
@@ -12,5 +13,7 @@ def configuration_context(request):  # pylint: disable=unused-argument
     Configuration context for django templates.
     """
     return {
-        'platform_name': configuration_helpers.get_value('platform_name', settings.PLATFORM_NAME)
+        'platform_name': configuration_helpers.get_value('platform_name', settings.PLATFORM_NAME),
+        'current_url': urlquote_plus(request.build_absolute_uri(request.path)),
+        'current_site_url': urlquote_plus(request.build_absolute_uri('/')),
     }

openedx/core/djangoapps/theming/tests/test_views.py

@@ -46,7 +46,7 @@ class TestThemingViews(TestCase):
         self.assertRedirects(
             response,
             '{login_url}?next={url}'.format(
-                login_url=settings.LOGIN_REDIRECT_URL,
+                login_url=settings.LOGIN_URL,
                 url=THEMING_ADMIN_URL,
             )
         )

openedx/core/djangoapps/user_authn/tests/test_utils.py

@@ -1,6 +1,8 @@
 """ Test User Authentication utilities """
 
+from collections import namedtuple
 import ddt
+
 from django.test import TestCase
 from django.test.client import RequestFactory
 from django.test.utils import override_settings
@@ -18,19 +20,27 @@ class TestRedirectUtils(TestCase):
         super(TestRedirectUtils, self).setUp()
         self.request = RequestFactory()
 
+    RedirectCase = namedtuple('RedirectCase', ['url', 'host', 'req_is_secure', 'expected_is_safe'])
+
     @ddt.data(
-        ('/dashboard', 'testserver', True),
-        ('https://edx.org/courses', 'edx.org', True),
-        ('https://test.edx.org/courses', 'edx.org', True),
-        ('https://www.amazon.org', 'edx.org', False),
-        ('http://edx.org/courses', 'edx.org', False),
-        ('http:///edx.org/courses', 'edx.org', False),  # Django's is_safe_url protects against "///"
+        RedirectCase('/dashboard', 'testserver', req_is_secure=True, expected_is_safe=True),
+        RedirectCase('https://test.edx.org/courses', 'edx.org', req_is_secure=True, expected_is_safe=True),
+        RedirectCase('https://www.amazon.org', 'edx.org', req_is_secure=True, expected_is_safe=False),
+
+        # https is required only if the request is_secure
+        RedirectCase('https://edx.org/courses', 'edx.org', req_is_secure=True, expected_is_safe=True),
+        RedirectCase('http://edx.org/courses', 'edx.org', req_is_secure=False, expected_is_safe=True),
+        RedirectCase('http://edx.org/courses', 'edx.org', req_is_secure=True, expected_is_safe=False),
+
+        # Django's is_safe_url protects against "///"
+        RedirectCase('http:///edx.org/courses', 'edx.org', req_is_secure=True, expected_is_safe=False),
     )
     @ddt.unpack
     @override_settings(LOGIN_REDIRECT_WHITELIST=['test.edx.org'])
-    def test_safe_redirect(self, url, host, expected_is_safe):
+    def test_safe_redirect(self, url, host, req_is_secure, expected_is_safe):
         """ Test safe next parameter """
         req = self.request.get('/login', HTTP_HOST=host)
+        req.is_secure = lambda: req_is_secure
         actual_is_safe = is_safe_login_or_logout_redirect(req, url)
         self.assertEqual(actual_is_safe, expected_is_safe)
 

openedx/core/djangoapps/user_authn/utils.py

@@ -23,5 +23,7 @@ def is_safe_login_or_logout_redirect(request, redirect_to):
         if redirect_to in application.redirect_uris:
             login_redirect_whitelist.add(urlparse(redirect_to).netloc)
 
-    is_safe_url = http.is_safe_url(redirect_to, allowed_hosts=login_redirect_whitelist, require_https=True)
+    is_safe_url = http.is_safe_url(
+        redirect_to, allowed_hosts=login_redirect_whitelist, require_https=request.is_secure(),
+    )
     return is_safe_url

openedx/core/djangoapps/user_authn/views/logout.py

@@ -29,11 +29,11 @@ class LogoutView(TemplateView):
     @property
     def target(self):
         """
-        If a redirect_url is specified in the querystring for this request, and the value is a url
-        with the same host, the view will redirect to this page after rendering the template.
+        If a redirect_url is specified in the querystring for this request, and the value is a safe
+        url for redirect, the view will redirect to this page after rendering the template.
         If it is not specified, we will use the default target url.
         """
-        target_url = self.request.GET.get('redirect_url')
+        target_url = self.request.GET.get('redirect_url') or self.request.GET.get('next')
 
         if target_url and is_safe_login_or_logout_redirect(self.request, target_url):
             return target_url