From 8217f68a0f92daab71eaa7a9dc56889179145a9a Mon Sep 17 00:00:00 2001
From: Akurosia Kamo <kamothegamer@web.de>
Date: Sun, 24 May 2026 08:02:32 +0200
Subject: [PATCH] fix login to keep url (again)

---
 auth/start.php            | 2 +-
 templates/login.php       | 2 +-
 templates/report-form.php | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/auth/start.php b/auth/start.php
index 0dec0e6..218d7ab 100644
--- a/auth/start.php
+++ b/auth/start.php
@@ -8,7 +8,7 @@ $state     = bin2hex(random_bytes(16));
 
 $_SESSION['pkce_verifier'] = $verifier;
 $_SESSION['oauth_state']   = $state;
-$_SESSION['oauth_return']  = null;
+$_SESSION['oauth_return']  = safe_return_path($_GET['return'] ?? null);
 
 $params = http_build_query([
     'response_type'         => 'code',
diff --git a/templates/login.php b/templates/login.php
index ef804a3..336f18c 100644
--- a/templates/login.php
+++ b/templates/login.php
@@ -21,7 +21,7 @@
       <?php endif; ?>
     </p>
 
-    <a href="auth/start.php" class="btn btn-gold btn-login">
+    <a href="<?= htmlspecialchars(auth_start_href(), ENT_QUOTES) ?>" class="btn btn-gold btn-login">
       <?= $tokenExpired ? 'Reconnect to FFLogs' : 'Connect to FFLogs' ?>
     </a>
 
diff --git a/templates/report-form.php b/templates/report-form.php
index 09da893..9f0c275 100644
--- a/templates/report-form.php
+++ b/templates/report-form.php
@@ -23,7 +23,7 @@
         </select>
       </div>
       <button class="btn btn-gold" type="submit" style="align-self:flex-end">Fetch</button>
-      <a class="btn" href="auth/start.php" style="align-self:flex-end;text-decoration:none">Reconnect</a>
+      <a class="btn" href="<?= htmlspecialchars(auth_start_href(), ENT_QUOTES) ?>" style="align-self:flex-end;text-decoration:none">Reconnect</a>
     </div>
   </form>
 </div>