@@ -236,6 +236,22 @@ func (p *OauthProxy) ManualSignIn(rw http.ResponseWriter, req *http.Request) (st
236236 return "", false
237237}
238238
239+func (p *OauthProxy) GetRedirect(req *http.Request) (string, error) {
240+ err := req.ParseForm()
241+
242+ if err != nil {
243+ return "", err
244+ }
245+
246+ redirect := req.FormValue("rd")
247+
248+ if redirect == "" {
249+ redirect = "/"
250+ }
251+
252+ return redirect, err
253+}
254+
239255func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
240256 // check if this is a redirect back at the end of oauth
241257 remoteIP := req.Header.Get("X-Real-IP")
@@ -246,13 +262,14 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
246262
247263 var ok bool
248264 var user string
249− redirect := req.FormValue("rd")
250−
251− if redirect == "" {
252− redirect = "/"
253− }
254265
255266 if req.URL.Path == signInPath {
267+ redirect, err := p.GetRedirect(req)
268+ if err != nil {
269+ p.ErrorPage(rw, 500, "Internal Error", err.Error())
270+ return
271+ }
272+
256273 user, ok = p.ManualSignIn(rw, req)
257274 if ok {
258275 p.SetCookie(rw, req, user)
@@ -263,8 +280,7 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
263280 return
264281 }
265282 if req.URL.Path == oauthStartPath {
266− // get the ?rd= value
267− err := req.ParseForm()
283+ redirect, err := p.GetRedirect(req)
268284 if err != nil {
269285 p.ErrorPage(rw, 500, "Internal Error", err.Error())
270286 return