{"action":"created","issue":{"url":"https://api.github.com/repos/laravel/framework/issues/15372","repository_url":"https://api.github.com/repos/laravel/framework","labels_url":"https://api.github.com/repos/laravel/framework/issues/15372/labels{/name}","comments_url":"https://api.github.com/repos/laravel/framework/issues/15372/comments","events_url":"https://api.github.com/repos/laravel/framework/issues/15372/events","html_url":"https://github.com/laravel/framework/pull/15372","id":176023604,"number":15372,"title":"[5.3] Flash messages are now displayed on login page when REFERER is not sent","user":{"login":"pgrenaud","id":10713979,"avatar_url":"https://avatars.githubusercontent.com/u/10713979?v=3","gravatar_id":"","url":"https://api.github.com/users/pgrenaud","html_url":"https://github.com/pgrenaud","followers_url":"https://api.github.com/users/pgrenaud/followers","following_url":"https://api.github.com/users/pgrenaud/following{/other_user}","gists_url":"https://api.github.com/users/pgrenaud/gists{/gist_id}","starred_url":"https://api.github.com/users/pgrenaud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pgrenaud/subscriptions","organizations_url":"https://api.github.com/users/pgrenaud/orgs","repos_url":"https://api.github.com/users/pgrenaud/repos","events_url":"https://api.github.com/users/pgrenaud/events{/privacy}","received_events_url":"https://api.github.com/users/pgrenaud/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-09T14:29:45Z","updated_at":"2016-09-09T14:37:18Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/laravel/framework/pulls/15372","html_url":"https://github.com/laravel/framework/pull/15372","diff_url":"https://github.com/laravel/framework/pull/15372.diff","patch_url":"https://github.com/laravel/framework/pull/15372.patch"},"body":"This is a fix for a bug I found while writing test for a project. If the client doesn't send a `REFERER` header when posting data on a login form, the client is not redirected properly and the flash messages (containing the errors) are lost in the process. \r\n\r\nThe bug occur in the following circumstances:\r\n* You have a route redirecting from `/` to `/login`\r\n* The client post his (wrong) credentials on the `/login` page without the  `REFERER` header\r\n* Laravel return `/` when executing `redirect()->back()` because the referer is missing and the session cannot be accessed (session is always `null`)\r\n* The client tries to access `/` but is redirected to `/login`, losing the flash messages (flash messages are flushed once the request is completed)\r\n* The client access `/login` with no error messages displayed\r\n\r\nHere's relevant code snippets mentioned in the flow above:\r\n* https://github.com/laravel/framework/blob/5.3/src/Illuminate/Foundation/Auth/AuthenticatesUsers.php#L118\r\n* https://github.com/laravel/framework/blob/5.3/src/Illuminate/Routing/Redirector.php#L55\r\n* https://github.com/laravel/framework/blob/5.3/src/Illuminate/Routing/UrlGenerator.php#L136\r\n\r\nThe bug affect 5.2 and 5.3 and exists since this commit: https://github.com/laravel/framework/commit/4326dc07d8d96161fdc18d0d5859928c395819ad\r\n\r\nThe fix I propose is relatively simple. It gives UrlGenerator access to the session, so it is able to access `$session->previousUrl()` when the referer is missing. The session is set from Redirector when `setSession($session)` is called."},"comment":{"url":"https://api.github.com/repos/laravel/framework/issues/comments/245932239","html_url":"https://github.com/laravel/framework/pull/15372#issuecomment-245932239","issue_url":"https://api.github.com/repos/laravel/framework/issues/15372","id":245932239,"user":{"login":"taylorotwell","id":463230,"avatar_url":"https://avatars.githubusercontent.com/u/463230?v=3","gravatar_id":"","url":"https://api.github.com/users/taylorotwell","html_url":"https://github.com/taylorotwell","followers_url":"https://api.github.com/users/taylorotwell/followers","following_url":"https://api.github.com/users/taylorotwell/following{/other_user}","gists_url":"https://api.github.com/users/taylorotwell/gists{/gist_id}","starred_url":"https://api.github.com/users/taylorotwell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/taylorotwell/subscriptions","organizations_url":"https://api.github.com/users/taylorotwell/orgs","repos_url":"https://api.github.com/users/taylorotwell/repos","events_url":"https://api.github.com/users/taylorotwell/events{/privacy}","received_events_url":"https://api.github.com/users/taylorotwell/received_events","type":"User","site_admin":false},"created_at":"2016-09-09T14:37:18Z","updated_at":"2016-09-09T14:37:18Z","body":"I don't understand why this is necessary because the URL generator already receives a session resolver in RoutingServiceProvider."}}
{"actor":{"display_login":"taylorotwell"}}