From 90ca1bf25ac356e02525f33a1c4ecc8980fadc03 Mon Sep 17 00:00:00 2001 From: Stephen Ritz <127270018+smpaz7467@users.noreply.github.com> Date: Tue, 14 Jul 2026 16:39:19 -0700 Subject: [PATCH] [Web] redirect deep links to the matching login page An unauthenticated request to a deep link such as /admin/dashboard was redirected to /, the user login, instead of the admin login. protect_route always sent unauthenticated visitors to /. Pick the login page from the request path: /admin/* redirects to /admin, /domainadmin/* to /domainadmin, everything else to / as before. Fixes #7284 Co-Authored-By: Claude Opus 4.8 (1M context) --- data/web/inc/functions.inc.php | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php index 89f14b574..a796f1587 100644 --- a/data/web/inc/functions.inc.php +++ b/data/web/inc/functions.inc.php @@ -3503,7 +3503,16 @@ function protect_route($allowed_roles = ['admin', 'domainadmin', 'user'], $redir if (isset($redirects['unauthenticated'])) { header('Location: ' . $redirects['unauthenticated']); } else { - header('Location: /'); + // Send a deep link to the login page for its area instead of the user login at /, + // e.g. /admin/dashboard -> /admin rather than / + $request_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '/'; + if (strpos($request_uri, '/admin/') === 0) { + header('Location: /admin'); + } elseif (strpos($request_uri, '/domainadmin/') === 0) { + header('Location: /domainadmin'); + } else { + header('Location: /'); + } } exit(); }