From cf123326b13e2f648b0a1cca4d8d1c7264e2e5d8 Mon Sep 17 00:00:00 2001
From: winter Sparkles
Date: Sun, 9 Aug 2026 16:22:51 +0100
Subject: put 'next' redirects also in logout page

---
 routes/logout.php | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

(limited to 'routes/logout.php')

diff --git a/routes/logout.php b/routes/logout.php
index 14fcedb..0729061 100644
--- a/routes/logout.php
+++ b/routes/logout.php
@@ -1,10 +1,17 @@
 <?php
 
-function GET() {
+function nextTarget(array $config) {
+    if (isset($_GET['next']) && Psso\isValidRedirect($_GET['next'], $config)) {
+        return $_GET['next'];
+    }
+    return '/';
+}
+
+function GET(array $config) {
     $session = Psso\Session::get();
     if ($session->getIdentity() === null) {
         // not actually logged in anyway
-        header('Location: /');
+        header('Location: ' . nextTarget($config));
         return;
     }
 
@@ -18,8 +25,8 @@ function GET() {
     $resp->send();
 }
 
-function POST() {
+function POST(array $config) {
     $session = Psso\Session::get();
     $session->setIdentity(null);
-    header('Location: /');
+    header('Location: ' . nextTarget($config));
 }
-- 
cgit v1.3