Persist destination on redirect

Dear Owen Barton

Thank you for this feature but if the verification fails user is being redirected to edit user and shows access denied and when it should sign the user out in that case.

Hi abdulaziz1zaid,

By mistake i have created below issue. Can you please close this issue.

https://www.drupal.org/project/email_tfa/issues/3231212

This is actually a serious problem that will affect many Drupal installs where users sign themselves up to the application. With this module disabled, a new user will sign up, get sent a welcome email with a link that guides them to set their own password for their account. With this module enabled, when a new user clicks the link in the welcome email, they will be asked for an email verification code. This is fine, because we already have their email at that point (by default Drupal requires an email be attached to every account), but the problem is that when this code is submitted, the user is redirected to the homepage, with their account still having the temporary password, making them unable to login to the site.

I understand your issue with the redirects being used in cases where the verification has failed, but perhaps we can persist the redirect to the profile page when the verification passes? I will look into this issue

The versions of this module seem to be being tracked strangely, so I was not able to create a merge request against the 1.0.5 branch of the module, but here is a patch which should work when applied on the latest 1.0.5 revision. If I was to gain access to the 1.0.5 branch, I would be able to produce a merge request to aid in the review of this contribution.

Hopefully this patch will help someone though.

With this change, a couple things happen:
1) Drupal tracks when a user is resetting their password via a cookie (which gets cleaned up after) and after the user passes the TFA challenge, they are then redirected to the password reset form, which mirrors Drupal core behavior. This also works when a user gets created with just an email and then gets guided to set a password.

2) Under all other normal circumstances, when a user logs in and passes the TFA challenge, they get redirected to their user profile edit page, in the same way that Drupal core behaves after a successful login.

Let me know if there are any questions here or if more detailed comments are needed in the added code.

Thank you for maintaining this module!

Small adjustment with an error handling for the situation I ran into where the $_SERVER superglobal with the key HTTP_REFERER does not exist. Functionally, this change should not alter from the original submission, but prevents a warning from being thrown.

Hi Everyone,

@mark.labrecque thank you for your patch but you can't use the static path and cookies.

I did a new patch to fix any destination.

after copying the work on the merge request I added the below code to the class EmailTfaVerifyForm and it is working well Thank you, Owen Barton.

    if ($this->request->query->get('destination')) {
      // save the destination in the $form_state to be used on submit.
      $form_state->set('destination', $this->request->query->get('destination'));
      //Remove the destination from the query string.
      $this->request->query->remove('destination');
    }   

on submit form :

      // get the destination from the $form_state.
      $destination = $form_state->get('destination');
      // use the destination from the $form_state if it exists
      if ($destination) {
        $url = Url::fromUserInput($destination);
      }
      else {
        $url = Url::fromRoute('<front>');
      }

FIXED.

Publish in version 1.0.7.