From 6bd64808df25a46fbe1c28a05dd4036798e7f513 Mon Sep 17 00:00:00 2001
From: jelveh <nj@puter.com>
Date: Mon, 2 Feb 2026 00:16:35 -0800
Subject: [PATCH] Add redirect_url handling and adjust auth flow

Set and propagate a redirect_url for auth flows and use it when navigating after login/signup to avoid leaking sensitive data.
---
 src/gui/src/UI/UIWindowAuthMe.js | 18 ------------------
 src/gui/src/UI/UIWindowLogin.js  |  9 +++++++--
 src/gui/src/UI/UIWindowSignup.js |  5 +++--
 src/gui/src/initgui.js           |  3 ++-
 4 files changed, 12 insertions(+), 23 deletions(-)

diff --git a/src/gui/src/UI/UIWindowAuthMe.js b/src/gui/src/UI/UIWindowAuthMe.js
index f1cfcc410..6cf5c2d42 100644
--- a/src/gui/src/UI/UIWindowAuthMe.js
+++ b/src/gui/src/UI/UIWindowAuthMe.js
@@ -84,24 +84,6 @@ async function UIWindowAuthMe (options = {}) {
         // Content area
         h += '<div style="padding: 20px;">';
 
-        // Info message
-        h += `<div style="
-            background: #f0f9ff;
-            border: 1px solid #bae6fd;
-            border-radius: 8px;
-            padding: 12px 14px;
-            margin-bottom: 16px;
-        ">`;
-        h += '<div style="display: flex; align-items: flex-start; gap: 10px;">';
-        h += `<svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="#0284c7" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="flex-shrink: 0; margin-top: 1px;">
-            <circle cx="12" cy="12" r="10"/>
-            <line x1="12" y1="16" x2="12" y2="12"/>
-            <line x1="12" y1="8" x2="12.01" y2="8"/>
-        </svg>`;
-        h += `<p style="margin: 0; font-size: 13px; color: #0369a1; line-height: 1.5;">${i18n('authme_security_warning')}</p>`;
-        h += '</div>';
-        h += '</div>';
-
         // Destination URL display
         h += '<div style="margin-bottom: 16px;">';
         h += `<label style="display: block; font-size: 12px; font-weight: 500; color: #6b7280; margin-bottom: 6px; text-transform: uppercase; letter-spacing: 0.5px;">${i18n('redirect_destination')}</label>`;
diff --git a/src/gui/src/UI/UIWindowLogin.js b/src/gui/src/UI/UIWindowLogin.js
index ca1bc4699..ff62d7d87 100644
--- a/src/gui/src/UI/UIWindowLogin.js
+++ b/src/gui/src/UI/UIWindowLogin.js
@@ -37,6 +37,11 @@ async function UIWindowLogin (options) {
         options.reload_on_success = true;
     }
 
+    if ( options.redirect_url === undefined )
+    {
+        options.redirect_url = window.location.href;
+    }
+
     return new Promise(async (resolve) => {
         const internal_id = window.uuidv4();
 
@@ -364,10 +369,9 @@ async function UIWindowLogin (options) {
                     window.update_auth_data(data.token, data.user);
 
                     if ( options.reload_on_success ) {
-                        sessionStorage.setItem('playChimeNextUpdate', 'yes');
                         window.onbeforeunload = null;
                         // Replace with a clean URL to prevent password leakage
-                        const cleanUrl = window.location.origin + window.location.pathname;
+                        const cleanUrl = options.redirect_url || window.location.origin + window.location.pathname;
                         window.location.replace(cleanUrl);
                     } else
                     {
@@ -471,6 +475,7 @@ async function UIWindowLogin (options) {
                 referrer: options.referrer,
                 show_close_button: options.show_close_button,
                 reload_on_success: options.reload_on_success,
+                redirect_url: options.redirect_url,
                 window_options: options.window_options,
                 send_confirmation_code: options.send_confirmation_code,
             });
diff --git a/src/gui/src/UI/UIWindowSignup.js b/src/gui/src/UI/UIWindowSignup.js
index 2e36b14c2..dc83e146f 100644
--- a/src/gui/src/UI/UIWindowSignup.js
+++ b/src/gui/src/UI/UIWindowSignup.js
@@ -44,7 +44,7 @@ function UIWindowSignup (options) {
 
         // Form
         h += '<div style="padding: 15px;">';
-        
+
         // title
         h += `<h1 class="signup-form-title">${i18n('create_free_account')}</h1>`;
         // signup form
@@ -189,6 +189,7 @@ function UIWindowSignup (options) {
             const login = await UIWindowLogin({
                 referrer: options.referrer,
                 reload_on_success: options.reload_on_success,
+                redirect_url: options.redirect_url,
                 window_options: options.window_options,
                 show_close_button: options.show_close_button,
                 send_confirmation_code: options.send_confirmation_code,
@@ -308,7 +309,7 @@ function UIWindowSignup (options) {
                     if ( options.reload_on_success ) {
                         window.onbeforeunload = null;
                         // Replace with a clean URL to prevent sensitive data leakage
-                        const cleanUrl = window.location.origin + window.location.pathname;
+                        const cleanUrl = options.redirect_url || window.location.origin + window.location.pathname;
                         window.location.replace(cleanUrl);
                     } else if ( options.send_confirmation_code ) {
                         $(el_window).close();
diff --git a/src/gui/src/initgui.js b/src/gui/src/initgui.js
index 800be705f..90b29d987 100644
--- a/src/gui/src/initgui.js
+++ b/src/gui/src/initgui.js
@@ -973,7 +973,7 @@ window.initgui = async function (options) {
     // -------------------------------------------------------------------------------------
     if ( !window.is_auth() && (!window.first_visit_ever || window.disable_temp_users) ) {
         const needs_action = action === 'authme' || action === 'copyauth';
-        const reload_on_success = !needs_action;
+        const reload_on_success = needs_action;
         if ( window.logged_in_users.length > 0 ) {
             await UIWindowSessionList({
                 reload_on_success,
@@ -986,6 +986,7 @@ window.initgui = async function (options) {
                 reload_on_success,
                 send_confirmation_code: false,
                 show_signup_button: ( !whoarewe.disable_user_signup ),
+                redirect_url: needs_action ? window.location.href : undefined,
                 window_options: {
                     has_head: false,
                 },