tschellenbach/Django-facebook — pull request #392 by jonathanendersby (2013-11-17 18:35:45+00:00)
Title: get_redirect_uri() should return some variation on the /facebook/connect URI

get_redirect_uri() should return some variation on the /facebook/connect URI

Previously: get_redirect_uri() always returned the current page's absolute URI,
which meant that if a non-logged-in user hit /settings, a view decorated with
@facebook_required, the redirect_uri that was sent to Facebook was the current
page's absolute URI (eg. http://www.foo.com/settings).

This incorrect URI meant that facebook would return the oauth session to
/settings?&code=AQCYz... etc. The 'settings' view does not know what to do
with the oauth data and everything falls apart quite dramatically.

This change makes get_redirect_uri always return the reversed URI for the
django_facebook.views.connect view.

In addition it now sets the next parameter based on some simple rules:

1. We should give preference to a param called 'next' in GET or POST.
2. If no 'next' exists in GET or POST but we are currently rendering the
django_facebook.views.connect page, set 'next' to the default set by
settings.FACEBOOK_LOGIN_DEFAULT_REDIRECT
3. Finally, if neither of the two previous conditionals were triggered, assume
that we should set 'next' to the current path. (eg. /settings').

I could of course have this all very wrong and be doing something very stupid,
but this change was the only way I could use django_facebook and have a
non-logged in user hit a view that was decorated by @facebook_required.
Perhaps I am missing something very obvious?