put 'next' redirects also in logout page

1 files changed, 11 insertions, 4 deletions

diff --git a/routes/logout.php b/routes/logout.php
index 14fcedb..0729061 100644
--- a/routes/logout.php
+++ b/routes/logout.php
@@ -1,10 +1,17 @@
 <?php
 
-function GET() {
+function nextTarget(array $config) {
+    if (isset($_GET['next']) && Psso\isValidRedirect($_GET['next'], $config)) {
+        return $_GET['next'];
+    }
+    return '/';
+}
+
+function GET(array $config) {
     $session = Psso\Session::get();
     if ($session->getIdentity() === null) {
         // not actually logged in anyway
-        header('Location: /');
+        header('Location: ' . nextTarget($config));
         return;
     }
 
@@ -18,8 +25,8 @@ function GET() {
     $resp->send();
 }
 
-function POST() {
+function POST(array $config) {
     $session = Psso\Session::get();
     $session->setIdentity(null);
-    header('Location: /');
+    header('Location: ' . nextTarget($config));
 }