From 92cd38cbb049a4bf7c9469233b8757df3a522603 Mon Sep 17 00:00:00 2001
From: Danielle McLean <dani@00dani.me>
Date: Fri, 3 Nov 2017 11:28:26 +1100
Subject: [PATCH] Make relative redirect URIs redirect to the right place, by
 urljoining them with the client ID

---
 lemonauth/templates/lemonauth/indie.html | 4 ++--
 lemonauth/views/indie.py                 | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/lemonauth/templates/lemonauth/indie.html b/lemonauth/templates/lemonauth/indie.html
index 90d18af..d13a48c 100644
--- a/lemonauth/templates/lemonauth/indie.html
+++ b/lemonauth/templates/lemonauth/indie.html
@@ -34,7 +34,7 @@
 			{% endfor %}
 			</div>
 			{% endif %}
-			<p class="card-text"><small>you will be redirected to <a class="code" href="{{ params.redirect_uri }}">{{ params.redirect_uri }}</a> after authorising this app</small></p>
+			<p class="card-text"><small>you will be redirected to <a class="code" href="{{ redirect_uri }}">{{ redirect_uri }}</a> after authorising this app</small></p>
 		</div>
 
 		<div class="card-footer">
@@ -47,7 +47,7 @@
 		{% csrf_token %}
 		<input name="me" type="hidden" value="{{ me }}" />
 		<input name="client_id" type="hidden" value="{{ params.client_id }}" />
-		<input name="redirect_uri" type="hidden" value="{{ params.redirect_uri }}" />
+		<input name="redirect_uri" type="hidden" value="{{ redirect_uri }}" />
 		{% if params.state %}<input name="state" type="hidden" value="{{ params.state }}" />{% endif %}
 		<input name="response_type" type="hidden" value="{{ params.response_type }}" />
 	</form>
diff --git a/lemonauth/views/indie.py b/lemonauth/views/indie.py
index 72f3489..9993d5e 100644
--- a/lemonauth/views/indie.py
+++ b/lemonauth/views/indie.py
@@ -51,6 +51,8 @@ class IndieView(TemplateView):
                 'you are logged in but not as {0}'.format(me)
             )
 
+        redirect_uri = urljoin(params['client_id'], params['redirect_uri'])
+
         type = params['response_type']
         if type not in ('id', 'code'):
             return utils.bad_req(
@@ -71,6 +73,7 @@ class IndieView(TemplateView):
                 .get('rels', ()))
         verified = 'redirect_uri' in rels
 
+
         try:
             app = client.to_dict(filter_by_type='h-x-app')[0]['properties']
         except IndexError:
@@ -79,6 +82,7 @@ class IndieView(TemplateView):
         return {
             'app': app,
             'me': me,
+            'redirect_uri': redirect_uri,
             'verified': verified,
             'params': params,
             'scopes': scopes,