1 files changed, 25 insertions, 4 deletions
diff --git a/src/frontend/pay.php b/src/frontend/pay.php
index 0ec87cf5..e13bed49 100644
--- a/src/frontend/pay.php
+++ b/src/frontend/pay.php
@@ -41,8 +41,6 @@ if (isset($_GET['backend_test']) &&  $_GET['backend_test'] == 'no')
   $backend_test = false;
 }
 
-
-
 if (!isset($_SESSION['H_contract']))
 {
   echo "No session active.";
@@ -50,6 +48,17 @@ if (!isset($_SESSION['H_contract']))
   return;
 }
 
+if (isset($_SESSION['payment_ok']) && $_SESSION['payment_ok'] == true)
+{
+  $_SESSION['payment_ok'] = true;
+  http_response_code (301);
+  //$url = (new http\URL("http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]"))
+  $url = (new http\URL("http://$_SERVER[HTTP_HOST]"))
+    ->mod(array ("path" => "fulfillment.php"), http\Url::JOIN_PATH);
+  header("Location: $url");
+  die();
+}
+
 $post_body = file_get_contents('php://input');
 
 $now = new DateTime('now');
@@ -84,7 +93,13 @@ if ($cli_debug && !$backend_test)
 
 
 // Backend is relative to the shop site.
-$url = (new http\URL("http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]"))
+/**
+ * WARNING: the "shop site" is '"http://".$_SERVER["HTTP_HOST"]'
+ * So do not attach $_SERVER["REQUEST_URI"] before proxying requests
+ * to the backend
+ */
+//$url = (new http\URL("http://".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]))
+$url = (new http\URL("http://".$_SERVER["HTTP_HOST"]))
   ->mod(array ("path" => "backend/pay"), http\Url::JOIN_PATH);
 
 $req = new http\Client\Request("POST",
@@ -118,7 +133,13 @@ else
 {
   $_SESSION['payment_ok'] = true;
   http_response_code (301);
-  $url = (new http\URL("http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]"))
+  /**
+   * WARNING: the "shop site" is '"http://".$_SERVER["HTTP_HOST"]'
+   * So do not attach $_SERVER["REQUEST_URI"] before proxying requests
+   * to the backend
+   */
+  //$url = (new http\URL("http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]"))
+  $url = (new http\URL("http://$_SERVER[HTTP_HOST]"))
     ->mod(array ("path" => "fulfillment.php"), http\Url::JOIN_PATH);
   header("Location: $url");
   die();