remove hard-coded /admin/ path (#2461)

2024-12-06 19:36:21 +01:00 · 2023-01-22 13:50:27 +00:00
parent ec7b7536c6 d94d86bad8
commit 1f194ef628
1 changed files with 5 additions and 1 deletions
@@ -68,7 +68,11 @@ function verifyPassword($pwhash, $use_api = false)
                $_SESSION['auth'] = true;

                // Login successful, redirect the user to the original requested page
-                if ($_SERVER['REQUEST_METHOD'] === 'POST' && $_SERVER['SCRIPT_NAME'] === '/admin/login.php') {
+                if (
+                    $_SERVER['REQUEST_METHOD'] === 'POST' &&
+                    strlen($_SERVER['SCRIPT_NAME']) >= 10 &&
+                    substr_compare($_SERVER['SCRIPT_NAME'], '/login.php', -10) === 0
+                ) {
                    header('Location: '.$redirect_url);
                    exit;
                }