Group Attendance Reminder Link Does Not Redirect Properly After Authentication

[dataCollegechurch]

Description

The Group Attendance Reminder Email uses this lava to generate a link for leaders to quickly review and enter attendance.

{% capture attendanceLink %}{{ 'Global' | Attribute:'PublicApplicationRoot' }}page/368?{{ Person.ImpersonationParameter }}&GroupId={{ Group.Id }}&Occurrence={{ Occurrence | Date:'yyyy-MM-ddTHH:mm:ss' | EscapeDataString }}{% endcapture %}

Users with elevate privileges may have the Impersonation blocked and the sytem will end up generating a link that look something like this.

http://www.rocksolidchurchdemo.com/page/368?rckipid=TokenProhibited&GroupId=117&Occurrence=2023-09-28T09%3A00%3A00

After the user navigates to this link they will be redirected to the login page and the url will look like this: https://www.rocksolidchurchdemo.com/page/207?returnurl=%252fpage%252f368%253fGroupId%253d117%2526Occurrence%253d2023-09-28T09%25253a00%25253a00

After the user logs in they will not be redirected back to http://www.rocksolidchurchdemo.com/page/368?rckipid=TokenProhibited&GroupId=117&Occurrence=2023-09-28T09%3A00%3A00 as desired. Instead they are redirected back to https://www.rocksolidchurchdemo.com/

Actual Behavior

User are redirected to homepage instead of page specified in redirecturl

Expected Behavior

User is always redirected to redirecturl's parameter value after logging if Redirect Page block setting is not set

Steps to Reproduce

1. Find or Setup a Small Group whose leader cannot be impersonated.
2. Generate a Small Group Reminder Email that uses the Core Group Attendance Reminder Email Template
3. Click on the Enter Attendance Button after receiving the email
4. Login
5. See Issue

Issue Confirmation

• Perform a search on the Github Issues to see if your bug or enhancement is already reported.
• Try to reproduce the problem on a fresh install or on the demo site.

Rock Version

15.1

Client Culture Setting

en-US

[dataCollegechurch]

Note: This issue appears to be present in both the Legacy Login Block and the Obsidian Login Block.

[rutledgek]

Yup, if in your email, you remove the escape data string from the date you should get redirected fine. The problem is that the data string is escaped here and then escaped again in the redirect to login steps. So when you try to login, the redirect url is unescaped once but again.

To fix the impersonation I also did this:

{% capture occurrenceDate %}{{ Occurrence | Date:'yyyyMMdd' }}{% endcapture %}
{% assign personToken = Person.ImpersonationParameter %}
{% capture link %}page/757?GroupId={{ Group.Id }}&Occurrence={{ Occurrence | Date:'yyyy-MM-dd' }}{% endcapture %}
{% capture attendanceLink %}
{% if personToken contains 'TokenProhibited' %}
    {{ 'Global' | Attribute:'PublicApplicationRoot' }}{{ link }}
{% else %}
    {{ 'Global' | Attribute:'PublicApplicationRoot' }}{{ link}}&{{ Person.ImpersonationParameter }}
{% endif %}
{% endcapture %}

Then use {{ attendanceLink }} in the email on the links.

I agree that the token creator should fail more graceully when the person cannot be impersonated, but there is a workaround.

[dataCollegechurch]

Is there any reason an occurrence parameter needs to have the time included?

[dataCollegechurch]

my typical fix for the TokenProhibited issue looks like this:
{% assign attendanceLink = attendanceLink | RegExReplace:'rckipid=TokenProhibited&','','i' %}

[shauncummings]

@dataCollegechurch and @rutledgek Thank you both for your work on this issue. There were two somewhat unrelated problems happening here:

1. The "TokenProhibited" value was causing a null reference error because the code attempted to decrypt this value as if it were a token. That was corrected in 23e4981.
2. Additionally, certain (slightly overzealous) security precautions were preventing your attendance reminder links from working if you accessed them without already being logged in from your current device/browser. The actual problem was not the URL escaping, but the fact that the default URL template included the time portion of the date, which is why @rutledgek's modified version works (because it omits the time). This was resolved in d090d7a.

These updates will be in the v16.1 release of Rock.