Plugin: Azure: Fix session redirect after login from custom page - refs BT#22335

Author: AngelFQC

main/inc/lib/api.lib.php

@@ -1449,7 +1449,7 @@ function api_protect_teacher_script()
 function api_block_anonymous_users($printHeaders = true)
 {
     $user = api_get_user_info();
-    if (!(isset($user['user_id']) && $user['user_id']) || api_is_anonymous($user['user_id'], true)) {
+    if (empty($user['user_id']) || api_is_anonymous($user['user_id'], true)) {
         api_not_allowed($printHeaders);
 
         return false;
@@ -4030,26 +4030,9 @@ function api_not_allowed(
 
     global $this_section;
 
-    // Check if a custom file (login.tpl) exists for custompages included overrides
-    if ((!isset($user_id) || api_is_anonymous()) && CustomPages::enabled()) {
-        $customLoginTemplate = Template::findTemplateFilePath('custompage/login.tpl');
-        if (file_exists(api_get_path(SYS_TEMPLATE_PATH).$customLoginTemplate)) {
-            if (empty($_SESSION['request_uri'])) {
-                $_SESSION['request_uri'] = $_SERVER['REQUEST_URI'];
-            }
-            $tpl = new Template(null, false, false);
-            $content = $tpl->fetch($customLoginTemplate);
-            $tpl->assign('content', $content);
-            $tpl->display_no_layout_template();
-            exit;
-        }
-    }
-
-    if (CustomPages::enabled() && !isset($user_id)) {
-        if (empty($user_id)) {
-            // Why the CustomPages::enabled() need to be to set the request_uri
-            $_SESSION['request_uri'] = $_SERVER['REQUEST_URI'];
-        }
+    if (CustomPages::enabled() && (empty($user_id) || api_is_anonymous())) {
+        // Why the CustomPages::enabled() need to be to set the request_uri
+        $_SESSION['request_uri'] = $_SERVER['REQUEST_URI'];
         CustomPages::display(CustomPages::INDEX_UNLOGGED);
     }
 

main/inc/lib/redirect.class.php

@@ -53,16 +53,17 @@ public static function go($url = '')
      */
     public static function session_request_uri($logging_in = false, $user_id = null)
     {
-        $no_redirection = isset($_SESSION['noredirection']) ? $_SESSION['noredirection'] : false;
+        $no_redirection = $_SESSION['noredirection'] ?? false;
+        $no_redirection = $GLOBALS['noredirection'] ?? $no_redirection;
 
         if ($no_redirection) {
             unset($_SESSION['noredirection']);
+            unset($GLOBALS['noredirection']);
 
             return;
         }
 
         $url = isset($_SESSION['request_uri']) ? Security::remove_XSS($_SESSION['request_uri']) : '';
-        unset($_SESSION['request_uri']);
 
         $afterLogin = Session::read('redirect_after_not_allow_page');
 
@@ -71,11 +72,11 @@ public static function session_request_uri($logging_in = false, $user_id = null)
             self::navigate($afterLogin);
         }
         if (!empty($url)) {
+            $_SESSION['custom_request_uri'] = $_SERVER['REQUEST_URI'];
+            unset($_SESSION['request_uri']);
             self::navigate($url);
-        } elseif ($logging_in ||
-            (isset($_REQUEST['sso_referer']) && !empty($_REQUEST['sso_referer']))
-        ) {
-            if (isset($user_id)) {
+        } elseif ($logging_in || !empty($_REQUEST['sso_referer'])) {
+            if (!empty($user_id)) {
                 $allow = api_get_configuration_value('plugin_redirection_enabled');
                 if ($allow) {
                     $allow = api_get_configuration_value('plugin_redirection_enabled');
@@ -121,8 +122,8 @@ public static function session_request_uri($logging_in = false, $user_id = null)
                 if (api_is_multiple_url_enabled()) {
                     // if multiple URLs are enabled, make sure he's admin of the
                     // current URL before redirecting
-                    $url = api_get_current_access_url_id();
-                    if (api_is_platform_admin_by_id($user_id, $url)) {
+                    $urlId = api_get_current_access_url_id();
+                    if (api_is_platform_admin_by_id($user_id, $urlId)) {
                         self::navigate(api_get_path(WEB_CODE_PATH).'admin/index.php');
                     }
                 } else {

plugin/azure_active_directory/src/callback.php

@@ -7,6 +7,8 @@
 
 use Chamilo\UserBundle\Entity\User;
 
+$GLOBALS['noredirection'] = empty($_GET) || isset($_GET['code']) || isset($_GET['state']) || isset($_GET['session_state']) || isset($_GET['error']);
+
 require __DIR__.'/../../../main/inc/global.inc.php';
 
 if (!empty($_GET['error']) && !empty($_GET['state'])) {
@@ -142,4 +144,7 @@
 ChamiloSession::write('_user', $userInfo);
 ChamiloSession::write('_user_auth_source', 'azure_active_directory');
 Event::eventLogin($userInfo['user_id']);
+
+$GLOBALS['noredirection'] = false;
+
 Redirect::session_request_uri(true, $userInfo['user_id']);