From 5b4e1ee6fc1b5f0acd1c4c5f92ed88111dcf5569 Mon Sep 17 00:00:00 2001 From: Karl Persson Date: Mon, 2 Jan 2023 16:45:45 +0100 Subject: [PATCH] Oauth: Remove extra decoding of redirect url (#60875) Oauth: remove extra decoding of redirect cookie url --- pkg/api/login_oauth.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/pkg/api/login_oauth.go b/pkg/api/login_oauth.go index 603f158611a..84bb08d7fe4 100644 --- a/pkg/api/login_oauth.go +++ b/pkg/api/login_oauth.go @@ -9,7 +9,6 @@ import ( "errors" "fmt" "net/http" - "net/url" "golang.org/x/oauth2" @@ -258,7 +257,7 @@ func (hs *HTTPServer) OAuthLogin(ctx *models.ReqContext) { hs.HooksService.RunLoginHook(&loginInfo, ctx) metrics.MApiLoginOAuth.Inc() - if redirectTo, err := url.QueryUnescape(ctx.GetCookie("redirect_to")); err == nil && len(redirectTo) > 0 { + if redirectTo := ctx.GetCookie("redirect_to"); len(redirectTo) > 0 { if err := hs.ValidateRedirectTo(redirectTo); err == nil { cookies.DeleteCookie(ctx.Resp, "redirect_to", hs.CookieOptionsFromCfg) ctx.Redirect(redirectTo)