I just upgraded to V2. In V1, I had login links with redirect_to that let users to redirect to that URL after login. But this is no more working after i upgraded to V2.
XenForo 2 redirect_to parameter on Login URL not working
- Thread starter releaseWeek
- Start date
-
- Tags
- redirect redirect_to
Thanks @Chris D for the response. Yes, it was redirect in XF1 instead of redirect_to.
But _xfRedirect is not working in XF2. I'm using this URL to login
https://www.toonzone.net/forums/index.php?login&_xfRedirect=https://www.toonzone.net/fansites/
It doesn't redirect user to the specified URL after login.
But _xfRedirect is not working in XF2. I'm using this URL to login
https://www.toonzone.net/forums/index.php?login&_xfRedirect=https://www.toonzone.net/fansites/
It doesn't redirect user to the specified URL after login.
Adding this here in case others find it searching the same problem. I could not make xf_Redirect work either, but here's what I found in my testing:
- xf_Redirect appears to be ignored if the redirect is to a different domain. It may also fail if http:// is in the url, I'm not sure.
- xf_Redirect works perfectly when redirecting to a file in its root directory. I set it up that way and made a file in the XF root that redirects to the desired url
An ugly hack but it works.
- xf_Redirect appears to be ignored if the redirect is to a different domain. It may also fail if http:// is in the url, I'm not sure.
- xf_Redirect works perfectly when redirecting to a file in its root directory. I set it up that way and made a file in the XF root that redirects to the desired url
An ugly hack but it works.
There is a very clear and obvious reason they don't redirect to external domains, that is a huge risk for phishing attacks as it is an open redirect.
www.trustwave.com
Understanding and Discovering Open Redirect Vulnerabilities
One of the most common and largely overlooked vulnerabilities by web developers is Open Redirect (also known as "Unvalidated Redirects and Forwards").
www.trustwave.com
