2010-01-20 135 views

回答

2

在登录到会话前存储页面,登录后从会话中读取前一页的URL并将使用重定向到该页面。

+0

它可以帮助您进行测试,如果您在某处放置了一个条件以防止您的代码尝试重定向到您刚刚来的页面。如果您在浏览器中看到重定向循环错误,则该情况可能会解决此问题。 – berty 2010-01-20 18:39:18

1

您可以将“返回”URL作为参数传递给登录页面。即http://yourserver.com/login/?return=http%3a%2f%2fyourserver.com%2fsomedir%2fsomething%2f。成功登录后,您可以使用get参数通过使用简单的HTTP标头location:http://yourserver.com/somedir/something/进行重定向。

这一点,例如,在不同的谷歌和微软的服务,其中有一个页面,用于登录,并要求用户不同的业务实践应在loogged。

+0

这是(imho)危险,因为URL可以更改。即用户可以看到一个看似与MS相关的URL(包含www.microsoft.com)的链接,然后登录并重定向到一个看起来像微软页面的恶意URL。 重定向到引用者是几乎一样危险,所以唯一安全的方法(用户)是存储原名URL的重定向到它:如果{StoreUrl(CURRENTURL (user.IsLoggedIn!): 任何网页); RedirectTo( “登录”); } 登录: if(LoginSuccessfull()){RedirectTo(GetStoredUrl()); } – dbemerlin 2010-01-20 12:31:17

+0

同意。事实上,登录页面应该验证“返回”路径,如果它是知道的原点。 – naivists 2010-01-20 12:37:44

1

您可以在此用行动帮助我写的前一段时间。干杯!

class Your_Controller_Action_Helper_GoBack 
extends Zend_Controller_Action_Helper_Abstract 
{ 
    /** 
    * @todo Check if redirecting to the same domain 
    * @param bool $required Throw exception? 
    * @param bool $validateDomain 
    * @param bool $allowSubdomain 
    * @param string $alternative URL to redirect to when validation fails and required = true 
    * @param string $anchorParam Request parameter name which holds anchor name (#). Redirect to page fragment is not allowed according to HTTP protocol specification, but browsers do support it 
    * @throws Zend_Controller_Action_Exception if no referer is specified and $required == false or $checkdomain is true and domains do not match 
    */ 
    public function direct($required = true, $anchorParam = null, $validateDomain = true, $allowSubdomain = false, $alternative = null) 
    { 
    $front = Zend_Controller_Front::getInstance(); 
    $request = $front->getRequest(); 

    $referer = $request->getPost('http_referer'); 

    if (empty($referer)) { 
    $referer = $request->getServer('HTTP_REFERER'); 
    if (empty($referer)) { 

    $referer = $request->getParam('http_referer'); 

    } 
    } 

    if (null === $alternative) { 
    $alternative = $request->getPost('http_referer'); 
    if (null === $alternative) { 
    $alternative = $request->getParam('http_referer'); 
    } 
    } 

    if ($referer) { 

    if ($validateDomain) { 
    if (!$this->validateDomain($referer, $allowSubdomain)) { 
     $this->_exception($alternative); 
    } 
    } 

    if (null != $anchorParam) { 
    $referer .= '#' . $request->getParam($anchorParam); 
    } 

    $redirector = new Zend_Controller_Action_Helper_Redirector(); 
    $redirector->gotoUrl($referer); 
    } elseif($required) { 
    $this->_exception($alternative); 
    } 
    } 

    /** 
    * @throws Zend_Controller_Action_Exception With specified message 
    * @param string $message Exception message 
    * @param string $alternative 
    */ 
    private function _exception($alternative = null, $message = 'HTTP_REFERER is required.') 
    { 
    if ($alternative) { 
    if (Zend_Uri::check($alternative)) { 
    $redirector = new Zend_Controller_Action_Helper_Redirector(); 
    $redirector->gotoUrl($alternative); 
    } 
    } 

    throw new Zend_Controller_Action_Exception($message); 
    } 


    /** 
    * Check if domain from current url and domain from specified url are the same 
    * @param string $url Target url 
    * @param string $allowSubdomain false 
    */ 
    public function validateDomain($url, $allowSubdomain = false) 
    { 
    if (!Zend_Uri::check($url)) { 

    return false; 
    } 

    $currentUri = $this->getCurrentUri(); 

    $uri = Zend_Uri_Http::fromString($currentUri); 
    $currentDomain = $uri->getHost(); 

    $uri = Zend_Uri_Http::fromString($url); 
    $target = $uri->getHost(); 

    if ($allowSubdomain) { 
    // Find second dot from the end 
    $pos = strrpos($target, '.'); 

    if (false !== $pos) { 
    $pos = strrpos(substr($target, 0, $pos), '.'); 

    if (false !== $pos) { 
     $target = substr($target, $pos+1); 
    } 
    } 
    } 

    if ($target === $currentDomain) { 
    return true; 
    } 

    return false; 
    } 

    /** 
    * @return string Current URL 
    */ 
    public function getCurrentUri() 
    { 
    $request = $this->getRequest(); 
    $path = $request->getRequestUri(); 

    $server = $request->getServer(); 

    $host = $request->getServer('HTTP_HOST'); 
    $protocol = $request->getServer('SERVER_PROTOCOL'); 

    if (!empty($protocol)) { 
    $protocol = explode('/', $protocol); 
    $protocol = strtolower($protocol[0]); 
    } 

    if (empty($protocol)) { 
    $protocol = 'http'; 
    } 

    $baseUrl = $protocol . '://' . $host . '/'; 

    $path = trim($path, '/\\'); 

    $url = $baseUrl . $path; 

    return $url; 
    } 

    /** 
    * Like str_replace, but only once 
    * @param string $search 
    * @param string $replace 
    * @param string $subject 
    */ 
    public function replaceOnce($search, $replace, $subject) 
    { 
    $firstChar = strpos($subject, $search); 
    if($firstChar !== false) { 
    $beforeStr = substr($subject, 0, $firstChar); 
    $afterStr = substr($subject, $firstChar + strlen($search)); 

    return $beforeStr . $replace . $afterStr; 
    } else { 

    return $subject; 
    } 
    } 
} 
相关问题