Redirect users to the page pointed in the URL after login

Question

In Joomla 3.5.1, I want to redirect users to a specific page, like:

https://www.domain.com/login?return=L2YlQzMlQjNydW0tcGVyZ3VudGFzLWUtcmVzcG9zdGFzL2NvbnZlcnNhdGlvbi9yZWFkLmh0bWw/aWQ9MjU=

Where the string ?return=XXX

At the end of the URL is supposed to indicate where the user should go after login as per:

https://docs.joomla.org/How_do_you_redirect_users_after_a_successful_login%3F

However, this isn't working: users are being redirected to the profile page.

PS: I'm using an override for com_users as per this other question.

NOTE:

base64_decode(L2YlQzMlQjNydW0tcGVyZ3VudGFzLWUtcmVzcG9zdGFzL2NvbnZlcnNhdGlvbi9yZW‌​FkLmh0bWw/aWQ9MjU=) 

Returns the URL that users should be redirected to.

NOTE2:

Below you may find the whole default_login.php code used in the override. It is working. Notice on lines 81-88 in the if statement where the condition if($_SERVER['QUERY_STRING']) is NOT redirecting to the URL I want although elseif($_SERVER['HTTP_REFERER']): is working perfectly redirecting to the page they were before logging in.

<?php
/**
 * @package     Joomla.Site
 * @subpackage  com_users
 *
 * @copyright   Copyright (C) 2005 - 2016 Open Source Matters, Inc. All rights reserved.
 * @license     GNU General Public License version 2 or later; see LICENSE.txt
 */

defined('_JEXEC') or die;

JHtml::_('behavior.keepalive');
?> 
<div class="login<?php echo $this->pageclass_sfx?>">
    <?php if ($this->params->get('show_page_heading')) : ?>
    <div class="page-header">
        <h1>
            <?php echo $this->escape($this->params->get('page_heading')); ?>
        </h1>
    </div>
    <?php endif; ?>

    <?php if (($this->params->get('logindescription_show') == 1 && str_replace(' ', '', $this->params->get('login_description')) != '') || $this->params->get('login_image') != '') : ?>
    <div class="login-description">
    <?php endif; ?>

        <?php if ($this->params->get('logindescription_show') == 1) : ?>
            <?php echo $this->params->get('login_description'); ?>
        <?php endif; ?>

        <?php if (($this->params->get('login_image') != '')) :?>
            <img src="<?php echo $this->escape($this->params->get('login_image')); ?>" class="login-image" alt="<?php echo JText::_('COM_USERS_LOGIN_IMAGE_ALT')?>"/>
        <?php endif; ?>

    <?php if (($this->params->get('logindescription_show') == 1 && str_replace(' ', '', $this->params->get('login_description')) != '') || $this->params->get('login_image') != '') : ?>
    </div>
    <?php endif; ?>

    <form action="<?php echo JRoute::_('index.php?option=com_users&task=user.login'); ?>" method="post" class="form-validate form-horizontal well">

        <fieldset>
            <?php foreach ($this->form->getFieldset('credentials') as $field) : ?>
                <?php if (!$field->hidden) : ?>
                    <div class="control-group">
                        <div class="control-label">
                            <?php echo $field->label; ?>
                        </div>
                        <div class="controls">
                            <?php echo $field->input; ?>
                        </div>
                    </div>
                <?php endif; ?>
            <?php endforeach; ?>

            <?php if ($this->tfa): ?>
                <div class="control-group">
                    <div class="control-label">
                        <?php echo $this->form->getField('secretkey')->label; ?>
                    </div>
                    <div class="controls">
                        <?php echo $this->form->getField('secretkey')->input; ?>
                    </div>
                </div>
            <?php endif; ?>

            <?php if (JPluginHelper::isEnabled('system', 'remember')) : ?>
            <div  class="control-group">
                <div class="control-label"><label><?php echo JText::_('COM_USERS_LOGIN_REMEMBER_ME') ?></label></div>
                <div class="controls"><input id="remember" type="checkbox" name="remember" class="inputbox" value="yes"/></div>
            </div>
            <?php endif; ?>

            <div class="control-group">
                <div class="controls">
                    <button type="submit" class="btn btn-primary">
                        <?php echo JText::_('JLOGIN'); ?>
                    </button>
                </div>
            </div>

            <?php if($_SERVER['QUERY_STRING']):
                $retorno=$_SERVER['QUERY_STRING'];
                $retorno=(str_replace('return=', '', $retorno)); ?>
                <input type="hidden" name="redirect" value="<?php echo urlencode(base64_encode($retorno));?>" />

            <?php elseif($_SERVER['HTTP_REFERER']): ?>
                <input type="hidden" name="return" value="<?php echo base64_encode($_SERVER['HTTP_REFERER']);?>" />
            <?php endif; ?>

            <?php echo JHtml::_('form.token'); ?>
        </fieldset>
    </form>
</div>
<div>
    <ul class="nav nav-tabs nav-stacked">
        <li>
            <a href="<?php echo JRoute::_('index.php?option=com_users&view=reset'); ?>">
            <?php echo JText::_('COM_USERS_LOGIN_RESET'); ?></a>
        </li>
        <li>
            <a href="<?php echo JRoute::_('index.php?option=com_users&view=remind'); ?>">
            <?php echo JText::_('COM_USERS_LOGIN_REMIND'); ?></a>
        </li>
        <?php
        $usersConfig = JComponentHelper::getParams('com_users');
        if ($usersConfig->get('allowUserRegistration')) : ?>
        <li>
            <a href="<?php echo JRoute::_('index.php?option=com_users&view=registration'); ?>">
                <?php echo JText::_('COM_USERS_LOGIN_REGISTER'); ?></a>
        </li>
        <?php endif; ?>
    </ul>
</div>

Answer 1

1. First of all, com_users login is written to use POST method, so adding ?return= don't give you anything, it won't work.

2. If we don't specify return in post data, model will use default pointing into profile.

3. Return must me an internal. Don't redirect to an external URL or it will be overwritten by default, profile redirect.

4. In view part, joomla check if you are in menu pointed into login, if you are, you can set a "Login redirect" param to point redirect. Param descriptions:

   • Login Redirect, If an URL is entered here, users will be redirected to it after login. The URL must not be an external one.

5. After all this, return is set into form value of return.

So from my perspective of code, creating template override is good, but remember to use internal links. That can pass JUri::isInternal validation.

EDIT: good use of return: <input type="hidden" name="return" value="<?php echo base64_encode('index.php?option=com_mycomponent&view=myview'); ?>"/>

EDIT 2: Rember never use JRoute in return it's not a valid internal URL... only index.php

Example:

<?php
        /**
         * Return Override  -   START
         */
        // grab old form Return Value
        $form_return = $this->form->getValue('return');
        $new_return = 'index.php?option=com_mycomponent&view=myview';
        ?>
        <input type="hidden" name="return" value="<?php echo base64_encode($this->params->get('login_redirect_url', $new_return)); ?>" />
        <?php
        /**
         * Return Override  -   End
         */
        ?>

So try this at home I dare you! ; )

Answer 2

I think you'll need to give a bit more detail to get an exact answer, but I suggest doing the following.

1. Add some text to your override file in order to make sure it is actually using that file to create your log-in. Note that the example given in the other question overrides the users component rather than the login module. If you are using the login module, you will need to override that instead.
2. Echo to screen the value of the return field, ie if you are using <input type="hidden" name="return" value="<?php echo base64_encode($_SERVER['HTTP_REFERER']); ?>" /> then write echo $_SERVER['HTTP_REFERER']; to screen - make sure it's the right URL.

If that does not work, I'd add the contents of your override file to your question, as that may give people more to go on.

(Also, as an aside - patching is important and 3.4.5 is out of date, though I don't believe this is a bug relating that that)

Update:

The problem might be that you are using $_SERVER['QUERY_STRING']) rather than the Joomla Framework's JInput to get your URL parameters.

See: https://docs.joomla.org/Retrieving_request_data_using_JInput

You also don't need that urlencode on something being base_64 encoded.

Further, you said you wanted to redirect to a specific page, but seem to be doing this as if the return value is going to be dynamic.

Lanah has also pointed out that $_SERVER['HTTP_REFERER'] can point to google.com or be empty if you come to the page directly. You might want to add additional validation for such occasions when this issue is resolved.

Answer 3

I do something similar on administrator sections. I redirect users to a specific component url after login: https://github.com/blackbricksoftware/joomla-adminredirect.

You need a plugin to hook into the onUserAfterLogin method of a user plugin. Replace out the main file in the example plugin above with something like this:

<?php defined('_JEXEC') or die;

// http://docs.joomla.org/Plugin/Events/System
// http://docs.joomla.org/J2.5:Creating_a_System_Plugin_to_augment_JRouter
// http://docs.joomla.org/J3.x:Creating_a_Plugin_for_Joomla

class PlgUserAdminRedirect extends JPlugin {

    public function __construct(&$subject, $config) {

        parent::__construct($subject, $config); 
    }

    public function onUserAfterLogin() {

        $app = JFactory::getApplication(); 
        $return = $app->input->getBase64('return');

        if (empty($return)) return;

        $app->redirect(JRoute::_($redirecturl,false));
    }
}