Currently module using destination service that fired always in \Drupal\masquerade\Controller\SwitchController::getRedirectResponse()
Also module does not properly check that HTTP_REFERER is external

Proposed to create JS destination for masquerade links and use code destination behavior

CommentFileSizeAuthor
#6 masquerade-2679088-redirect.patch917 bytesrealgt
#5 masquerade-2679088-redirect.patch917 bytesrealgt
#4 masquerade-2679088-redirect.patch1.03 KBrealgt

Comments

andypost created an issue. See original summary.

realgt’s picture

realgt commented

this issue is happening for me as well, when you unmasquerade the redirect takes you back to <front> page instead of previous page (although i don't propose the js destination solution)

realgt’s picture

realgt commented

affects 8.x-2.0-beta4

realgt’s picture

realgt commented
StatusFileSize
new masquerade-2679088-redirect.patch1.03 KB

heres a patch that allowed unmasquerade redirect to function correctly

realgt’s picture

realgt commented
StatusFileSize
new masquerade-2679088-redirect.patch917 bytes

updated patch fixes paths

realgt’s picture

realgt commented
StatusFileSize
new masquerade-2679088-redirect.patch917 bytes

update to remove trailing whitespace

andypost’s picture

andypost
he/him
Primary language Russian
commented

From security POV the referrer header is insecure and surely can't be used instead of destination

interdruper’s picture

interdruper commented
Status: Active » Needs work

IMHO, src/Controller/SwitchController.php would need a little refactoring. Right now the referer is ignored, since destination always is valid and it contains the url defined in the route 'masquerade.unmasquerade', that is:

/unmasquerade?token=...

If the refererer exists, an additional parameter would be required, that is:

/unmasquerade?token=...&destination=/referer/path

murz’s picture

murz
Primary language English
Location Yerevan, Armenia
commented

As an alternative, we can fill "&destination" parameter on /unmasquerade link at frontend via JS, for keep this link cacheable globally, not per-url. And maybe even do this at "onClick" event.

pelicani’s picture

pelicani commented

Note : another patch is available that handles this situation really well ...
https://www.drupal.org/project/masquerade/issues/3158235
this patch handles the referrer without adding a destination to the url.

solideogloria’s picture

solideogloria commented
Status: Needs work » Closed (duplicate)

Closing as a duplicate of the other issue.

#3158235: MasqueradeBlock & getRedirectResponse improvements

Patch #4 of the linked issue works nicely.