From d15041f84713e60eb28a6e22fadfd80ab3cd76b0 Mon Sep 17 00:00:00 2001
From: Tom Hughes <tom@compton.nu>
Date: Sat, 6 Feb 2021 15:04:33 +0000
Subject: [PATCH] Use POST to submit OpenID login form

Fixes #3084
---
 app/assets/javascripts/login.js | 14 ---------
 app/views/users/login.html.erb  | 55 ++++++++++++++++-----------------
 2 files changed, 27 insertions(+), 42 deletions(-)

diff --git a/app/assets/javascripts/login.js b/app/assets/javascripts/login.js
index 8963c07b6..5853193bc 100644
--- a/app/assets/javascripts/login.js
+++ b/app/assets/javascripts/login.js
@@ -24,18 +24,4 @@ $(document).ready(function () {
   // Hide OpenID field for now
   $("#login_openid_url").hide();
   $("#login_openid_submit").hide();
-
-  // Handle OpenID submission by redirecting to omniauth
-  $("#openid_login_form").submit(function () {
-    var action = $(this).prop("action"),
-        openid_url = $(this).find("#openid_url").val(),
-        referer = $(this).find("#openid_referer").val(),
-        args = {};
-    args.openid_url = openid_url;
-    if (referer) {
-      args.referer = referer;
-    }
-    window.location = action + "?" + Qs.stringify(args);
-    return false;
-  });
 });
diff --git a/app/views/users/login.html.erb b/app/views/users/login.html.erb
index 78ba25fa4..ab54fba82 100644
--- a/app/views/users/login.html.erb
+++ b/app/views/users/login.html.erb
@@ -21,48 +21,47 @@
     <%= f.primary t(".login_button"), :tabindex => 4 %>
   <% end %>
 
-  <%= form_tag(auth_path(:provider => "openid"), :id => "openid_login_form") do %>
-    <div id="loginForm" class="standard-form">
+  <div id="loginForm" class="standard-form">
 
-      <fieldset class='form-divider'>
+    <fieldset class='form-divider'>
 
-        <p class='standard-label'><%= t ".with external" %></p>
+      <p class='standard-label'><%= t ".with external" %></p>
 
-        <ul class='list-unstyled' id="login_auth_buttons">
-          <li><%= link_to image_tag("openid.png", :alt => t(".auth_providers.openid.title")), "#", :id => "openid_open_url", :title => t(".auth_providers.openid.title") %></li>
-          <% if Settings.key?(:google_auth_id) -%>
-          <li><%= auth_button "google", "google" %></li>
-          <% end -%>
-          <% if Settings.key?(:facebook_auth_id) -%>
-          <li><%= auth_button "facebook", "facebook" %></li>
-          <% end -%>
-          <% if Settings.key?(:windowslive_auth_id) -%>
-          <li><%= auth_button "windowslive", "windowslive" %></li>
-          <% end -%>
-          <% if Settings.key?(:github_auth_id) -%>
-          <li><%= auth_button "github", "github" %></li>
-          <% end -%>
-          <% if Settings.key?(:wikipedia_auth_id) -%>
-          <li><%= auth_button "wikipedia", "wikipedia" %></li>
-          <% end -%>
-          <li><%= auth_button "yahoo", "openid", :openid_url => "yahoo.com" %></li>
-          <li><%= auth_button "wordpress", "openid", :openid_url => "wordpress.com" %></li>
-          <li><%= auth_button "aol", "openid", :openid_url => "aol.com" %></li>
-        </ul>
+      <ul class='list-unstyled' id="login_auth_buttons">
+        <li><%= link_to image_tag("openid.png", :alt => t(".auth_providers.openid.title")), "#", :id => "openid_open_url", :title => t(".auth_providers.openid.title") %></li>
+        <% if Settings.key?(:google_auth_id) -%>
+        <li><%= auth_button "google", "google" %></li>
+        <% end -%>
+        <% if Settings.key?(:facebook_auth_id) -%>
+        <li><%= auth_button "facebook", "facebook" %></li>
+        <% end -%>
+        <% if Settings.key?(:windowslive_auth_id) -%>
+        <li><%= auth_button "windowslive", "windowslive" %></li>
+        <% end -%>
+        <% if Settings.key?(:github_auth_id) -%>
+        <li><%= auth_button "github", "github" %></li>
+        <% end -%>
+        <% if Settings.key?(:wikipedia_auth_id) -%>
+        <li><%= auth_button "wikipedia", "wikipedia" %></li>
+        <% end -%>
+        <li><%= auth_button "yahoo", "openid", :openid_url => "yahoo.com" %></li>
+        <li><%= auth_button "wordpress", "openid", :openid_url => "wordpress.com" %></li>
+        <li><%= auth_button "aol", "openid", :openid_url => "aol.com" %></li>
+      </ul>
 
+      <%= form_tag(auth_path(:provider => "openid"), :id => "openid_login_form") do %>
         <div id='login_openid_url' class='standard-form-row'>
           <label for='openid_url' class="standard-label"><%= t ".openid_html", :logo => openid_logo %></label>
-          <%= hidden_field_tag("openid_referer", params[:referer]) if params[:referer] %>
+          <%= hidden_field_tag("referer", params[:referer]) %>
           <%= text_field_tag("openid_url", "", :tabindex => 3, :class => "openid_url") %>
           <span class="minorNote">(<a href="<%= t "users.account.openid.link" %>" target="_new"><%= t "users.account.openid.link text" %></a>)</span>
         </div>
 
         <%= submit_tag t(".login_button"), :tabindex => 6, :id => "login_openid_submit" %>
+      <% end %>
 
       </fieldset>
 
     </div>
 
-  <% end %>
-
 </div>
-- 
2.43.2