fix: Send users to their group homepage after MFA

[hellopablo]

Problem

generateToken() falls back to $oInput::server('URI_STRING') when no explicit return_to is supplied:

static::TOKEN_DATA_KEY_RETURN_TO => $oInput::get('return_to') ?: $oInput::server('URI_STRING'),

Input::server() reads $_SERVER, and URI_STRING is never set there by the framework or by any consuming app — the idiom is the uri_string() helper, which the Uri service even advertises as @method uri_string().

So the fallback always evaluates empty and false is stored. On success redirect(false) coerces to '', siteUrl('') resolves to the site root, and the user lands on the public homepage.

On the site where this was found that accounted for 64 of 86 logins in the sample period — members should have gone to /dashboard and staff to /admin.

Why not just use uri_string()

It would be wrong here. generateToken() runs after the logout inside authenticate(), during the POST to /auth/login, so the current URI is the login page — honouring it would bounce users back to where they started.

The correct fallback is the user's group homepage, which is exactly what module-auth does itself:

// auth/controllers/Login.php:251
$sRedirectUrl = $this->data['return_to'] ? $this->data['return_to'] : $oUser->group_homepage;

That line never runs in the MFA case, because this module's LogIn listener redirects during the USER_LOG_IN event. The legacy MFA implementation in module-auth (src/Controller/BaseMfa.php:194) got this right too; this module reimplemented it and regressed.

Also in here

The success log used $sRedirectUrl ?? siteUrl(), but ?? does not catch false, so it logged an empty destination. The target is now coalesced once at source and both the log and the redirect use it.

Verified

Full flow against a user in a group with default_homepage = /admin:

MFA form: HTTP 200
verify:   HTTP 302
Location: https://localhost/admin

Log now reads User verified successfully, redirecting to "/admin" rather than "".

Made with Cursor