fix(oauth2): Add missing urlencode for failure redirection

come-nc · backportbot[bot] · commit 8a4516637ab2 · 2026-04-21T09:10:16.000Z
Signed-off-by: Côme Chilliet &lt;come.chilliet@nextcloud.com&gt;
diff --git a/apps/oauth2/lib/Controller/LoginRedirectorController.php b/apps/oauth2/lib/Controller/LoginRedirectorController.php
@@ -106,7 +106,7 @@ public function authorize($client_id,
 
 		if ($response_type !== 'code') {
 			//Fail
-			$url = $client->getRedirectUri() . '?error=unsupported_response_type&state=' . $state;
+			$url = $client->getRedirectUri() . '?error=unsupported_response_type&state=' . \urlencode($state);
 			return new RedirectResponse($url);
 		}
 

Original file line number	Diff line number	Diff line change
`@@ -106,7 +106,7 @@ public function authorize($client_id,`
`106`	`106`
`107`	`107`	`if ($response_type !== 'code') {`
`108`	`108`	`//Fail`
`109`		`- $url = $client->getRedirectUri() . '?error=unsupported_response_type&state=' . $state;`
	`109`	`+ $url = $client->getRedirectUri() . '?error=unsupported_response_type&state=' . \urlencode($state);`
`110`	`110`	`return new RedirectResponse($url);`
`111`	`111`	`}`
`112`	`112`