You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ofbiz.apache.org by "nmalin (via GitHub)" <gi...@apache.org> on 2026/07/21 15:00:29 UTC
[PR] Improved: previous request information lost at login [ofbiz-framework]
nmalin opened a new pull request, #1479:
URL: https://github.com/apache/ofbiz-framework/pull/1479
Currently, when you arrive on OFBiz after the login page, you're redirected to the default request even though you have specified a URI.
Try to log on to https://localhost:8443/webtools/control/entity/find/Party, you are redirected to the login page, and after login, OFBiz returns to the page https://localhost:8443/webtools/control/main instead of the asked URI: entity/find/Party
This comes from issue OFBIZ-12047 (d60bf1574b, 33fe2aaba5) where we remove the previous request on the 'login' URI to be sure to clean it.
We reversed the logic, and set the previous request only when checkLogin controls a request that needs authentication and isn't an AJAX call or login (or related) URL.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Improved: previous request information lost at login [ofbiz-framework]
Posted by "nmalin (via GitHub)" <gi...@apache.org>.
nmalin commented on PR #1479:
URL: https://github.com/apache/ofbiz-framework/pull/1479#issuecomment-5045621760
Hello @jacopoc, Yes, I agree.
I try to find the good way on this spaghetti mix. I exposed my advancement on it and like you spot it, it's not enough.
I would like to secure the _PREVIOUS_REQUEST_ attribute at the beginning for that, but as it's a sensible area, I clearly wait for your (or some other) approval.
I needed to move forward on other things, but sure, I'll look into it to solve that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Improved: previous request information lost at login [ofbiz-framework]
Posted by "jacopoc (via GitHub)" <gi...@apache.org>.
jacopoc commented on PR #1479:
URL: https://github.com/apache/ofbiz-framework/pull/1479#issuecomment-5045081656
Hi @nmalin
The issue you have identified may be a side effect of one of the fixes to security vulnerabilities I pushed this year.
However, this pull request (re?)introduces a security vulnerability (see the CodeQL report), so it cannot be pushed in its current form. Please have a look when you have time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org