mirror of
https://github.com/discourse/discourse.git
synced 2024-11-22 19:46:55 +08:00
34a76bf106
destination_url cookie is used to redirect the user to the a private page after they have logged in. After deleting own account, a user's pages would be refreshed which would set the destination_url, cookie that can cause a redirect to an invalid page after logging in again. Reproduction steps: 1. User is at `/u/:username/preferences/account` and deletes account by requesting DELETE `/u/:username.json`. 2. User is being destroyed and a MessageBus message (`file-change`, `['refresh']`) is published. 3. User receives response to DELETE request, but page may be or not refreshed. Anyway, since they can no longer see the preferences page, they are redirected to `/login` and `destination_url` cookie is set, that will redirect on next login (but to the previous preferences page). |
||
|---|---|---|
| .. | ||
| assets | ||
| controllers | ||
| helpers | ||
| jobs | ||
| mailers | ||
| models | ||
| serializers | ||
| services | ||
| views | ||