Currently we compare the destination url against $_GET['q'] and against drupal_get_path_alias($_GET['q']).

If the destination url is not an internal path, but an absolute url to an internal page then this check won't detect the loop.

If we use drupal_get_normal_path() on both $url and $current_path, then convert both normalized paths to absolute urls with url() then compare the two results we should have a more robust way to detect redirect loops in a single if() statement.

Comments

thedavidmeister’s picture

drupal_get_normal_path() does not work correctly on $_GET['q']. Need to use request_path(), so I'm going to say this issue is blocked by #1890080: Use request_path() instead of $_GET['q'] in context_redirect_validate_redirect().

thedavidmeister’s picture

Status: Active » Needs review
StatusFileSize
new1.6 KB

This patch combines #1890080: Use request_path() instead of $_GET['q'] in context_redirect_validate_redirect() with what I was saying about normalizing urls/paths before comparing them.

It lets you do "stupid" things like set a sitewide redirect to or http://example.com (where example.com is your current site) and simply be redirected to the front page without loops.

kevinquillen’s picture

Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.