[Findit] Redirect to original page after login for triage.

appengine/findit/common/base_handler.py

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import collections
 import json
 import logging
 
 from google.appengine.api import users
 import jinja2
@@ skipping 20 matching lines @@
   ADMIN = 0
   CORP_USER = 8
   ANYONE = 16
 
 
 class BaseHandler(webapp2.RequestHandler):
   # By default, set permission level to ADMIN only.
   # Subclass needs to overwrite it explicitly to give wider access.
   PERMISSION_LEVEL = Permission.ADMIN
 
+  # By default, redirect to destination page after login for GET requests.
+  LOGIN_REDIRECT_TO_DISTINATION_PAGE_FOR_GET = True
+
   def _HasPermission(self):
     if (self.request.headers.get('X-AppEngine-QueueName') or
         self.request.headers.get('X-AppEngine-Cron')):
       # Requests from task queues or cron jobs could access all HTTP endpoints.
       return True
     elif self.PERMISSION_LEVEL == Permission.ANYONE:
       return True
     elif self.PERMISSION_LEVEL == Permission.CORP_USER:
       # Only give access to google accounts or admins.
       return self.IsCorpUserOrAdmin()
@@ skipping 94 matching lines @@
       content_type = 'text/html'
 
     if cache_expiry is not None:
       self.response.headers['cache-control'] = (
           'max-age=%s, public' % cache_expiry)
     self.response.headers['Content-Type'] = content_type
     self.response.write(data)
 
   def GetLoginUrl(self):
     """Returns the login url."""
-    if self.request.method == 'GET':
-      # For GET, all parameters are included in the URL.
+    # For GET, all parameters are included in the URL. So it is safe to redirect
+    # to the destination page. However, for POST, the parameters could be in the
+    # body and include files, so it is better to redirect to the original page.
+    if (self.request.method == 'GET' and
+        self.LOGIN_REDIRECT_TO_DISTINATION_PAGE_FOR_GET):
       return users.create_login_url(self.request.url)
     else:
-      # For others like POST, the parameters could be in the body and include
-      # file, etc. Thus return to the original page if available.
       return users.create_login_url(self.request.referrer)
 
   def _Handle(self, handler_func):
     try:
       if not self._HasPermission():
         template = 'error.html'
         data = {
             'error_message':
                 ('Either not login or no permission. '
                  'Please login with your google.com account.'),
@@ skipping 20 matching lines @@
       return_code = 500
       cache_expiry = None
 
     self._SendResponse(template, data, return_code, cache_expiry)
 
   def get(self):
     self._Handle(self.HandleGet)
 
   def post(self):
     self._Handle(self.HandlePost)