From af98e7a12694d94abc3ea439b114f4ac9c310fab Mon Sep 17 00:00:00 2001 From: Maxence Lange Date: Mon, 15 Jun 2026 20:28:57 -0100 Subject: [PATCH] fix(oidc): state might be used in session keys Signed-off-by: Maxence Lange --- lib/Master.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/Master.php b/lib/Master.php index 2f861dc..4d65e83 100644 --- a/lib/Master.php +++ b/lib/Master.php @@ -137,7 +137,10 @@ public function handleLoginRequest( 'providerId' => $this->session->get(\OCA\UserOIDC\Controller\LoginController::PROVIDERID) ]; // TODO: switch 'oidc.redirect' to \OCA\UserOIDC\Controller\LoginController::REDIRECT_AFTER_LOGIN once switched to public - $options['target'] = $this->forceRelativeUrl($this->session->get('oidc.redirect') ?? '/'); + $state = $this->request->getParam('state') ?? ''; + $sessionKeySuffix = ($state !== '') ? '-' . $state : ''; + $redirect = $this->session->get('oidc.redirect') ?? $this->session->get('oidc.redirect' . $sessionKeySuffix) ?? '/'; + $options['target'] = $this->forceRelativeUrl($redirect); // Fix: restore the slave flow path into options.target after all backend blocks. //