From 0282194c205816309dacbbd8fe562ebc10eaf143 Mon Sep 17 00:00:00 2001
From: mark_story <mark@mark-story.com>
Date: Fri, 14 Sep 2012 09:39:45 -0400
Subject: [PATCH] Make permission denied redirects host relative.

This helps fix infinite redirect loops when HTTP_X_FORWARDED_HOST is
set, and fixes redirects back to external domains on authentication
errors.

Fixes #3207
---
 lib/Cake/Controller/Component/AuthComponent.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/Cake/Controller/Component/AuthComponent.php b/lib/Cake/Controller/Component/AuthComponent.php
index c0869571f9a..3ce93c9993b 100644
--- a/lib/Cake/Controller/Component/AuthComponent.php
+++ b/lib/Cake/Controller/Component/AuthComponent.php
@@ -332,7 +332,7 @@ public function startup(Controller $controller) {
 		if (!empty($this->loginRedirect)) {
 			$default = $this->loginRedirect;
 		}
-		$controller->redirect($controller->referer($default), null, true);
+		$controller->redirect($controller->referer($default, true), null, true);
 		return false;
 	}