{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/8689","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8689/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8689/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8689/events","html_url":"https://github.com/joomla/joomla-cms/issues/8689","id":122106497,"number":8689,"title":"REGRESSION - Wrong redirect after login on front-end since 3.4.6","user":{"login":"Klipper","id":3924467,"avatar_url":"https://avatars.githubusercontent.com/u/3924467?v=3","gravatar_id":"","url":"https://api.github.com/users/Klipper","html_url":"https://github.com/Klipper","followers_url":"https://api.github.com/users/Klipper/followers","following_url":"https://api.github.com/users/Klipper/following{/other_user}","gists_url":"https://api.github.com/users/Klipper/gists{/gist_id}","starred_url":"https://api.github.com/users/Klipper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Klipper/subscriptions","organizations_url":"https://api.github.com/users/Klipper/orgs","repos_url":"https://api.github.com/users/Klipper/repos","events_url":"https://api.github.com/users/Klipper/events{/privacy}","received_events_url":"https://api.github.com/users/Klipper/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/joomla/joomla-cms/labels/No%20Code%20Attached%20Yet","name":"No Code Attached Yet","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":78,"created_at":"2015-12-14T18:54:33Z","updated_at":"2015-12-15T23:45:21Z","closed_at":null,"body":"#### Steps to reproduce the issue\r\n- In administrator create menu-item to login-page (index.php?option=com_users&view=login).\r\n- On the options tab of 'Menus: Edit Item': add URL at 'Login redirect'\r\n\r\n#### Expected result\r\nRedirect to entered URL after login. \r\n\r\n\r\n#### Actual result\r\nReload front-end, click the login link, enter Username and Password in the presented login-form and login. You will get redirected to the user profile of the user who login, instead of to the url you added at the 'Login redirect' option.\r\n\r\n\r\n#### System information (as much as possible)\r\nRedirect worked like a charm in 3.4.5 and before...\r\nThe trouble started with the 3.4.6 update. \r\n\r\n\r\n#### Additional comments\r\nTested on 6 different sites and on multiple hosts too.\r\nFor best compare:\r\n\r\nAdd a redirect-url in Joomla 3.4.5 you will see correct redirect, after update to 3.4.6 redirect to the url fails and userprofile will be showed.\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/164937659","html_url":"https://github.com/joomla/joomla-cms/issues/8689#issuecomment-164937659","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8689","id":164937659,"user":{"login":"PhilETaylor","id":400092,"avatar_url":"https://avatars.githubusercontent.com/u/400092?v=3","gravatar_id":"","url":"https://api.github.com/users/PhilETaylor","html_url":"https://github.com/PhilETaylor","followers_url":"https://api.github.com/users/PhilETaylor/followers","following_url":"https://api.github.com/users/PhilETaylor/following{/other_user}","gists_url":"https://api.github.com/users/PhilETaylor/gists{/gist_id}","starred_url":"https://api.github.com/users/PhilETaylor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PhilETaylor/subscriptions","organizations_url":"https://api.github.com/users/PhilETaylor/orgs","repos_url":"https://api.github.com/users/PhilETaylor/repos","events_url":"https://api.github.com/users/PhilETaylor/events{/privacy}","received_events_url":"https://api.github.com/users/PhilETaylor/received_events","type":"User","site_admin":false},"created_at":"2015-12-15T23:45:21Z","updated_at":"2015-12-15T23:45:21Z","body":"@chrisdavenport 3.4.6 is already released - I think you mean 3.4.7 - and this is not a reason for a release.\r\n\r\n@barrycox - you have bigger fish to fry - like your http://www.skyrun.com/autocomplete.php is accessible to SQL injection, plainly gives the sql in plain text so hackers know exactly what to hack!!! You should remove/harden this asap!   If you conduct a real search http://www.skyrun.com/autocomplete.php?search=8401 then you see that the json is \r\n\r\n```\r\n[\r\n{\r\nvalue: \"index.php?option=com_jomholiday&view=item&id=1&Itemid=185\",\r\ntitle: \"8401 Buffalo Lodge \",\r\ntext: \"Keystone 1br Condo\",\r\nimage: \"undefined\"\r\n}\r\n]\r\n\r\n```\r\n\r\nThis has absolutly nothing to do with the isInternal hardening - if you can provide the source of autocomplete.php then maybe I can advice you better, however nothing I see here leads me to believe that this is connected. "}}