routes/continue.php


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

<?php

// this is the confusingly named cookie-relay page

function GET(array $config) {
    $ci = array_search($_SERVER['HTTP_HOST'],
                       $config['site']['cookie-domains'] ?? []);
    if ($ci === false) {
        header('Location: https://' . $config['site']['primary-domain']);
        return;
    }
    if (!isset($_GET['sid'])) {
        header('Location: /');
        return;
    }

    Psso\Session::override($_GET['sid']);

    $nextDomain = $config['site']['cookie-domains'][$ci + 1] ?? null;
    if (!isset($nextDomain)) {
        $redir = $_GET['next'] ?? null;
        if (isset($redir) && Psso\isValidRedirect($redir, $config)) {
            header('Location: ' . $redir);
        } else {
            header('Location: https://' . $config['site']['primary-domain']);
        }
        return;
    }
    $target = 'Location: https://' . $nextDomain . '/continue'
            . '?sid=' . urlencode($_GET['sid']);
    if (isset($_GET['next'])) $target .= '&next=' . urlencode($_GET['next']);
    header('Location: ' . $target);
}