Force redirect headers to use absolute URLs as per spec (though

browsers seem to accept relative ones); escape the page name
on the login cookie check.

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index 86038f5..5dd58a6 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -246,6 +246,11 @@ class OutputPage {
                header( "Content-language: {$wgLanguageCode}" );
                
                if ( "" != $this->mRedirect ) {
+                       if( substr( $this->mRedirect, 0, 4 ) != "http" ) {
+                               # Standards require redirect URLs to be absolute
+                               global $wgServer;
+                               $this->mRedirect = $wgServer . $this->mRedirect;
+                       }
                        header( "Location: {$this->mRedirect}" );
                        return;
                }

diff --git a/includes/SpecialUserlogin.php b/includes/SpecialUserlogin.php
index 584f810..b18e501 100644 (file)
--- a/includes/SpecialUserlogin.php
+++ b/includes/SpecialUserlogin.php
@@ -386,7 +386,7 @@ $cambutton
 {
        global $wgOut, $wgLang;
 
-       $check = wfLocalUrl( $wgLang->specialPage( "Userlogin" ),
+       $check = wfLocalUrl( wfUrlEncode( $wgLang->specialPage( "Userlogin" ) ),
                         "wpCookieCheck=$type" );
 
        return $wgOut->redirect( $check );