Active
Project:
Subscription Manager
Version:
1.0.x-dev
Component:
Code
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
14 Oct 2026 at 21:29 UTC
Updated:
14 Oct 2026 at 21:29 UTC
Jump to comment: Most recent
Both submit handlers in the .module file call SubscriptionManagerService::shouldRedirectCurrentUserOnLogin(), which loads \Drupal::currentUser(). On the login form that is the account that just logged in. On the register form it is whoever submitted the form:
/admin/people/create the current user is the administrator, so the administrator is the one redirected to the plan chooser after creating someone else's account.Neither submit handler has a test. The destination check in the service reads the POST body only, never the query string the login form carries; harmless today because core's redirect subscriber wins, but equally untested.
$form_state->get('user'), which core sets); otherwise leave core's redirect alone.destination query is not redirected.None intended; the 403 goes away.
None.
None.
Comments