bborn/communityengine — pull request #62 by harmsk (2012-02-29 20:49:16+00:00)
Title: Redirect for login does not always work

The before_filter, login_required calls store_location. However, if you don't need login_required (because anonymous access is fine) you will be redirected to the last page which used the login_required filter. This can be confusing, but not problematic. However, if the last request was an update request, this URL is stored as part of the session, which means you may update a model many times unintentionally. Further, session[:return_to] is not cleared on log out. This means that if a user logs out and another user logs in using the same browser they may be redirected to same page they never should have been redirected to.

I've attached a patch which attempts to resolve these issues. However, I'm not sure if this is the best way to resolve this particular issue but at least I've tested it and know it works.