views: pass ?next= to mellon views (#61430)

combo/public/views.py

@@ -41,6 +41,7 @@ from django.template import engines
 from django.template.loader import TemplateDoesNotExist, get_template
 from django.utils import lorem_ipsum, timezone
 from django.utils.encoding import force_text
+from django.utils.http import urlencode
 from django.utils.translation import ugettext as _
 from django.views.decorators.csrf import csrf_exempt
 from django.views.defaults import page_not_found
@@ -70,13 +71,10 @@ else:
 class LoginView(auth_views.LoginView):
     def dispatch(self, request, *args, **kwargs):
         if any(get_idps()):
-            if 'next' not in request.GET:
-                return HttpResponseRedirect(resolve_url('mellon_login'))
-            try:
-                quoted_next_url = urllib.parse.quote(request.GET.get('next'))
-            except KeyError:
-                return HttpResponseBadRequest('invalid value for "next" parameter')
-            return HttpResponseRedirect(resolve_url('mellon_login') + '?next=' + quoted_next_url)
+            url = resolve_url('mellon_login')
+            if 'next' in request.GET:
+                url += '?' + urlencode({'next': request.GET['next']})
+            return HttpResponseRedirect(url)
         return super().dispatch(request, *args, **kwargs)
 
 
@@ -85,7 +83,10 @@ login = LoginView.as_view()
 
 def logout(request, next_page=None):
     if any(get_idps()):
-        return HttpResponseRedirect(resolve_url('mellon_logout'))
+        url = resolve_url('mellon_logout')
+        if 'next' in request.GET:
+            url += '?' + urlencode({'next': request.GET['next']})
+        return HttpResponseRedirect(url)
     auth_logout(request)
     if next_page is not None:
         next_page = resolve_url(next_page)