{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/11533","repository_url":"https://api.github.com/repos/joomla/joomla-cms","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/11533/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/11533/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/11533/events","html_url":"https://github.com/joomla/joomla-cms/pull/11533","id":170227738,"number":11533,"title":"Set login/logout form actions to \"index.php\"","user":{"login":"jo-sf","id":8342125,"avatar_url":"https://avatars.githubusercontent.com/u/8342125?v=3","gravatar_id":"","url":"https://api.github.com/users/jo-sf","html_url":"https://github.com/jo-sf","followers_url":"https://api.github.com/users/jo-sf/followers","following_url":"https://api.github.com/users/jo-sf/following{/other_user}","gists_url":"https://api.github.com/users/jo-sf/gists{/gist_id}","starred_url":"https://api.github.com/users/jo-sf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jo-sf/subscriptions","organizations_url":"https://api.github.com/users/jo-sf/orgs","repos_url":"https://api.github.com/users/jo-sf/repos","events_url":"https://api.github.com/users/jo-sf/events{/privacy}","received_events_url":"https://api.github.com/users/jo-sf/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/joomla/joomla-cms/labels/PR-staging","name":"PR-staging","color":"c7def8"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-09T17:44:19Z","updated_at":"2016-08-09T19:37:44Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/joomla/joomla-cms/pulls/11533","html_url":"https://github.com/joomla/joomla-cms/pull/11533","diff_url":"https://github.com/joomla/joomla-cms/pull/11533.diff","patch_url":"https://github.com/joomla/joomla-cms/pull/11533.patch"},"body":"Login and Logout form actions set to \"index.php\", in doing so undoing the change made Dec 8, 2014.\r\n\r\nReason for this change is that `JRoute::_()` doesn't honor the third parameter (the \"usesecure\" flag) when a complete URL is passed, this is due to the following lines in that method:\r\n\r\n```\r\nif (!is_array($url) && (strpos($url, '&') !== 0) && (strpos($url, 'index.php') !== 0))\r\n{\r\n        return $url;\r\n}\r\n```\r\n\r\nAssume that `http://www.example.org/index.php` is the current URL which is passed as a string as first parameter to `JRoute::_()`. A string is not an array, there is no \"&\" in the string (so `strpos()` returns `false` which is not identical to \"0\") and the substring \"index.php\" doesn't start at position 0 in the string. Therefore the given URL is returned without any modifications, here: no changing of the scheme to HTTPS if the flag \"usesecure\" is set.\r\n\r\nIt is no problem to pass simply \"index.php\" here as action since the real target after logging in is passed in the hidden field \"return\".\r\n\r\n#### Testing Instructions\r\n\r\nFor testing this change you need a current Joomla installation with the sample data installed.\r\n\r\n**Preparations**\r\n\r\n* log in to the administration\r\n* **important**: check that caching is disabled, if not disable it and clear the site cache\r\n* open \"Extensions\", \"Modules\"\r\n* search for all site modules containing the string \"login\" - you should find 3 such modules\r\n* open the \"Login Form\" module (this should be positioned at \"position-7\")\r\n* change \"Encrypt Login Form\" to \"Yes\" and save the settings\r\n\r\n**Status Quo**\r\n\r\n* open the site homepage using HTTP\r\n* locate the login form in the bottom right of the page\r\n* check the login form action, it should be something like `http://<server>/index.php`\r\n* log in using any valid user and password\r\n* you're still visiting the site via HTTP\r\n* log out and close the site homepage\r\n\r\n**Changes**\r\n\r\n* install this PR\r\n* open the site homepage using HTTP\r\n* locate the login form and check the login form action, now it should be something like `https://<server>/index.php`\r\n* log in using any valid user and password\r\n* you should now visit the site via HTTPS, the current page is probably the user profile (this is somewhat unexpected, but this is another issue to be fixed separately)\r\n* go the the site homepage\r\n* locate the logout form and check the logout form action, it should be something like `https://<server>/index.php`\r\n* log out, afterwards you still visit the site via HTTPS (this again is another issue to be fixed separately)\r\n* close the site homepage"},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/238666490","html_url":"https://github.com/joomla/joomla-cms/pull/11533#issuecomment-238666490","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/11533","id":238666490,"user":{"login":"andrepereiradasilva","id":9630530,"avatar_url":"https://avatars.githubusercontent.com/u/9630530?v=3","gravatar_id":"","url":"https://api.github.com/users/andrepereiradasilva","html_url":"https://github.com/andrepereiradasilva","followers_url":"https://api.github.com/users/andrepereiradasilva/followers","following_url":"https://api.github.com/users/andrepereiradasilva/following{/other_user}","gists_url":"https://api.github.com/users/andrepereiradasilva/gists{/gist_id}","starred_url":"https://api.github.com/users/andrepereiradasilva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrepereiradasilva/subscriptions","organizations_url":"https://api.github.com/users/andrepereiradasilva/orgs","repos_url":"https://api.github.com/users/andrepereiradasilva/repos","events_url":"https://api.github.com/users/andrepereiradasilva/events{/privacy}","received_events_url":"https://api.github.com/users/andrepereiradasilva/received_events","type":"User","site_admin":false},"created_at":"2016-08-09T19:37:44Z","updated_at":"2016-08-09T19:37:44Z","body":"I have tested this item :white_check_mark: successfully on 8dd80b34df13b50b933f1c166099ffcc45ef2c3a<br /><br />works as expected.\n\nIMHO we should have the same behaviour in the offline pages (protostar and system).\nBut i guess that needs a parameter at user component level.<hr /><sub>This comment was created with the <a href=\"https://github.com/joomla/jissues\">J!Tracker Application</a> at <a href=\"https://issues.joomla.org/tracker/joomla-cms/11533\">issues.joomla.org/joomla-cms/11533</a>.</sub>"}}
{"actor":{"display_login":"andrepereiradasilva"}}