[5.x]: redirectInput ignored with actionInput('users/set-password')

[corneliusio]

What happened?

Description

Currently working on front-end user accounts and have run into an issue where redirectInput is not respected after a user resets their password.

Steps to reproduce

{% extends 'accounts/_layout' %}

{% set code = craft.app.request.getQueryParam('code') %}
{% set id = craft.app.request.getQueryParam('id') %}

{% block content %}
    <div class="mx-auto max-w-md">
        <header class="mb-12">
            <h1 class="text-3xl sm:text-4xl">{{ ('Reset Password')|t }}</h1>
        </header>

        <form class="grid gap-6" method="post" accept-charset="UTF-8">
            {{ actionInput('users/set-password') }}
            {{ redirectInput('accounts/login') }}
            {{ hiddenInput('code', code) }}
            {{ hiddenInput('id', id) }}
            {{ csrfInput() }}

            <div class="fui-field-container">
                <label for="password" class="fui-label">{{ ('New Password')|t }}</label>
                <input type="password"
                    name="newPassword"
                    id="password"
                    class="fui-input"
                    placeholder=" " />
            </div>

            <div class="fui-field-container">
                <button class="fui-btn">{{ ('Reset Password')|t }}</button>
            </div>

            {% if errorMessage is defined %}
                <p>{{ errorMessage }}</p>
            {% endif %}
        </form>
    </div>
{% endblock %}

Expected behavior

User is redirected to the path passed to the redirectInput helper function.

Actual behavior

User is redirected to the home page.

Craft CMS version

Craft Pro 5.3.4

PHP version

8.3.8

Operating system and version

Linux 6.9.8

Database type and version

MySQL 8.0.36

Image driver and version

Imagick 3.7.0

Installed plugins and versions

Amazon S3           2.2.1
Button Box          5.0.0
CKEditor            4.1.0
Digital Download    3.1.1
Element API         4.1.0
Embedded Assets     5.1.1
Expanded Singles    3.0.0
Formie              3.0.1
Hyper               2.0.4
Icon Picker         3.0.0
Matrix Extended     3.5.0
Retcon              3.2.0
SendGrid            3.0.0
SEO                 5.1.1
Vite                5.0.0

[brandonkelly]

Technically this is what the setPasswordSuccessPath config setting is for, but I agree that a redirect input should be respected if present. Just fixed that for the next Craft 4 and 5 releases.

[corneliusio]

@brandonkelly Thanks for the quick fix!

Just to double check, I attempted adding the following to config/general.php and found that the user was still getting redirected to the default instead of the provided value. Am I missing anything? I have run into a bit of confusion regarding whether these config items are meant to be template paths or URL paths.

return [
    // …
    'setPasswordSuccessPath' => App::env('PRIMARY_SITE_URL') . '/accounts/login',
    // …
];

[brandonkelly]

@corneliusio Does the user have access to the control panel? If so they will be redirected there instead.

[corneliusio]

@brandonkelly I have only tested it with an account that has CP access, so yes. If that's the only factor here than that should be perfectly fine.

[brandonkelly]

Yeah… and even in that case, the redirect input will still take precedence starting in the next release.

[corneliusio]

@brandonkelly Much appreciated!

[brandonkelly]

Craft 4.11.4 and 5.3.5 are out with that change.