mirror of
https://github.com/galaxyproject/galaxy.git
synced 2026-08-31 01:02:04 +08:00
Dannon Baker
f0e576120a
Adversarial review caught this and it is a genuine regression for prefixed deployments. request.path_qs includes SCRIPT_NAME, and every consumer downstream re-applies the app root on its own -- url_for coming back out of the OIDC callback, withPrefix on the local login path, and the client router's own base. So under a /galaxy prefix the destination became /galaxy/galaxy/tool_landings/... and 404'd. Before these commits the cookie was never set at all, so a prefixed instance quietly landed you on the home page; with the cookie set it would have 404'd instead, which is worse. Sending path_info rather than path fixes the paths I added and the local login path, which has had the same double-prefix through withPrefix all along. Verified by reverting to path_qs -- the new prefixed-deployment test fails.