TYPO3 Core

This option typolinkLinkAccessRestrictedPages does not influence the way felogin handle the return_url/redirect_url GET parameter.
It just allows typolink to link access restricted page with the add of the return_url/redirect_url GET parameter.

The bug I describe resides in felogin and is a regression introduced with the extbase refactoring of the plugin.

I can confirm this problem in TYPO3 10.4.12

A q&d workaround: /typo3/sysext/felogin/Classes/Controller/LoginController.php

- 'redirectURL' => $this->redirectHandler->getLoginFormRedirectUrl($this->configuration, $this->isRedirectDisabled()),
+ 'redirectURL' => $this->redirectHandler->getLoginFormRedirectUrl($this->configuration,TRUE),

The problem is simple to explain:
there's this condition in \TYPO3\CMS\FrontendLogin\Controller\LoginController::initializeAction

if ($this->isLoginOrLogoutInProgress() && !$this->isRedirectDisabled()) {

'redirectURL' => $this->redirectHandler->getLoginFormRedirectUrl($this->configuration, $this->isRedirectDisabled()),

I can also confirm this issue and not working scenario B. I use the extension pagenotfoundhandling with additional get param redirect_url=###CURRENT_URL###. The extbase felogin hidden form element is not filled anymore with TYPO3 10.4 and there is no redirect after login to the login protected page.

Just noticed, that /login?return_url=/private-page works as expected, while redirect_url doesn't (as stated above). hth

This issue still exists with TYPO3 10.4.17. Any news here? thanks

This issue still exists with TYPO3 10.4.21. Any news here? thanks

Harald Witt wrote in #note-12:

...
The old return_url is now better called as referer. So the following works perfect:
www.your-domain.de/login?referer=WhereYouWantToGotoAfterLogin
...

The referer works, but the redirect_url still does not work. So scenario B is not working with TYPO3 10.4.22.
(The ?redirect_url=/private-page GET parameter is not propagated to the <input hidden name="redirect_url">)

This issue still exists in TYPO3 10.4.22. No updates here?

This issue still exists in TYPO3 11.5.4

This is a fundamental problem. The core 403 error handler does not take any core login-redirect mechanisms into account (be it redirect_url, return_url or referer, be it GET or POST - all is just dropped).

The felogin redirect handler \TYPO3\CMS\FrontendLogin\Redirect\RedirectHandler does this:

    protected function getLoginRedirectUrl(array $redirectModes, int $redirectPageLogin): string
    {
        if ($this->isRedirectModeActive($redirectModes, RedirectMode::LOGIN)) {
            return $this->redirectModeHandler->redirectModeLogin($redirectPageLogin);
        }
        return $this->getGetpostRedirectUrl($redirectModes);
    }

As soon as the Flexform has mode "login" configured at all (mode "login" = take the page from the flexform), it ALWAYS wins. this is what the if-condition says. No matter what else is in the list, no matter if the checkbox for the first found method is set or not.

This is just plain wrong. Why have the priority list and the checkbox at all if an hardcoded value just wins always?

As soon as I remove mode "login" from the flexform selection the redirecting works fine. But I don't want to remove it. Because users that just directly go to the login page (no POST/GET/referer) should as a fallback get to the site configured in the Flexform.

Oh, If I remove redirect mode "login" and have NO GET/POST variable, then actually logging in (athenticating) just stops working. ":)"

If I XCLASS this RedirectHandler and just remove the whole if condition then everthing works.

The getLoginFormRedirectUrl function is actually wrong here. This function is providing the redirectURL variable which is used in Fluid template to handover the given redirect URL exclusively for GET/POST redirect evaluation. The function should not take any other configured redirect modes into account. The handling of configured redirects actually happens in the processRedirect function, which respects the configured redirect mode order.

Patch set 1 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/73784

Patch set 1 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/73785