be more defensive about redirecting to logout in login controller

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

Author: julien-nc

lib/Controller/LoginController.php

@@ -209,6 +209,16 @@ private function buildProtocolErrorResponse(?bool $throttle = null): TemplateRes
 	 * @return DataDisplayResponse|RedirectResponse|TemplateResponse
 	 */
 	public function login(int $providerId, string $redirectUrl = null) {
+		// to be safe, avoid redirecting to logout or single-logout
+		$logoutUrl = $this->urlGenerator->linkToRoute('core.login.logout');
+		$userOidcLogoutUrl = $this->urlGenerator->linkToRoute(Application::APP_ID . '.login.singleLogoutService');
+		if (
+			$redirectUrl
+			&& (strpos($redirectUrl, $logoutUrl) !== false || strpos($redirectUrl, $userOidcLogoutUrl) !== false)
+		) {
+			$redirectUrl = $this->urlGenerator->getBaseUrl();
+		}
+
 		if ($this->userSession->isLoggedIn()) {
 			return new RedirectResponse($redirectUrl);
 		}