From e7e110c1401135ee57cdbef5d62d826076d39961 Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Wed, 25 Jan 2023 15:16:28 +0000 Subject: [PATCH] [v9.3.x] Oauth: Remove extra decoding of redirect url (#60878) Oauth: Remove extra decoding of redirect url (#60875) Oauth: remove extra decoding of redirect cookie url (cherry picked from commit 5b4e1ee6fc1b5f0acd1c4c5f92ed88111dcf5569) Co-authored-by: Karl Persson --- pkg/api/login_oauth.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/pkg/api/login_oauth.go b/pkg/api/login_oauth.go index 603f158611a..84bb08d7fe4 100644 --- a/pkg/api/login_oauth.go +++ b/pkg/api/login_oauth.go @@ -9,7 +9,6 @@ import ( "errors" "fmt" "net/http" - "net/url" "golang.org/x/oauth2" @@ -258,7 +257,7 @@ func (hs *HTTPServer) OAuthLogin(ctx *models.ReqContext) { hs.HooksService.RunLoginHook(&loginInfo, ctx) metrics.MApiLoginOAuth.Inc() - if redirectTo, err := url.QueryUnescape(ctx.GetCookie("redirect_to")); err == nil && len(redirectTo) > 0 { + if redirectTo := ctx.GetCookie("redirect_to"); len(redirectTo) > 0 { if err := hs.ValidateRedirectTo(redirectTo); err == nil { cookies.DeleteCookie(ctx.Resp, "redirect_to", hs.CookieOptionsFromCfg) ctx.Redirect(redirectTo)