From da6e7893acf9a65e202ba9265e77899035884b6e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ciar=C3=A1n=20Ainsworth?= <ciaranainsworth@outlook.com>
Date: Mon, 26 Jul 2021 18:54:14 +0000
Subject: [PATCH] Prevent open redirect on login

---
 front/src/router/index.js      |  1 +
 front/src/views/auth/Login.vue | 22 ++++++++++++++++------
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/front/src/router/index.js b/front/src/router/index.js
index 314bf5b1d..bd0c7c7cf 100644
--- a/front/src/router/index.js
+++ b/front/src/router/index.js
@@ -1025,6 +1025,7 @@ export default new Router({
     },
     {
       path: '*',
+      name: '404',
       component: () =>
         import(/* webpackChunkName: "core" */ '@/components/PageNotFound')
     }
diff --git a/front/src/views/auth/Login.vue b/front/src/views/auth/Login.vue
index 3a5b076da..a63716555 100644
--- a/front/src/views/auth/Login.vue
+++ b/front/src/views/auth/Login.vue
@@ -3,30 +3,40 @@
     <section class="ui vertical stripe segment">
       <div class="ui small text container">
         <h2><translate translate-context="Content/Login/Title/Verb">Log in to your Funkwhale account</translate></h2>
-        <login-form :next="next"></login-form>
+        <login-form :next="redirectTo"></login-form>
       </div>
     </section>
   </main>
 </template>
 
 <script>
-import LoginForm from "@/components/auth/LoginForm"
+import LoginForm from '@/components/auth/LoginForm'
 
 export default {
   props: {
-    next: { type: String, default: "/library" }
+    next: { type: String, default: '/library' }
+  },
+  data () {
+    return {
+      redirectTo: this.next
+    }
   },
   components: {
     LoginForm
   },
   created () {
+    const resolved = this.$router.resolve(this.redirectTo)
+    console.log(resolved.route.name)
+    if (resolved.route.name === '404') {
+      this.redirectTo = '/library'
+    }
     if (this.$store.state.auth.authenticated) {
-      this.$router.push(this.next)
+      this.$router.push(this.redirectTo)
     }
   },
   computed: {
-    labels() {
-      let title = this.$pgettext('Head/Login/Title', "Log In")
+    labels () {
+      const title = this.$pgettext('Head/Login/Title', 'Log In')
       return {
         title
       }