MDL-67053 login: Allow bypassing alternateurl config

auth/tests/behat/login.feature

@@ -61,3 +61,10 @@ Feature: Authentication
     When I am on site homepage
     Then the page should meet "wcag143" accessibility standards
     And the page should meet accessibility standards with "wcag143" extra tests
+
+  Scenario: Alternate login URL can be bypassed
+    Given the following config values are set as admin:
+        | alternateloginurl | https://www.google.com/ |
+    And I am on site homepage
+    When I visit "/login/index.php?loginredirect=0"
+    Then I should see "Log in to Acceptance test site"

lib/upgrade.txt

@@ -19,6 +19,7 @@ information provided here is intended especially for developers.
   that are also members of these groups.
 * The options for `format_string()`, and `format_text()` are now checked for incorrectly passed context objects.
   Please note that this was never an accepted value but previously failed silently.
+* Login can now utilise new param 'loginredirect' to indicate when to use value set for $CFG->alternateloginurl.
 
 === 4.3 ===
 

login/index.php

@@ -31,6 +31,7 @@ redirect_if_major_upgrade_required();
 
 $testsession = optional_param('testsession', 0, PARAM_INT); // test session works properly
 $anchor      = optional_param('anchor', '', PARAM_RAW);     // Used to restore hash anchor to wantsurl.
+$loginredirect = optional_param('loginredirect', 1, PARAM_BOOL);   // Used to bypass alternateloginurl.
 
 $resendconfirmemail = optional_param('resendconfirmemail', false, PARAM_BOOL);
 
@@ -274,6 +275,9 @@ if ($frm and isset($frm->username)) {                             // Login WITH
         unset($SESSION->loginerrormsg);
         unset($SESSION->logininfomsg);
 
+        // Discard loginredirect if we are redirecting away.
+        unset($SESSION->loginredirect);
+
         // test the session actually works by redirecting to self
         $SESSION->wantsurl = $urltogo;
         redirect(new moodle_url(get_login_url(), array('testsession'=>$USER->id)));
@@ -313,8 +317,14 @@ if (empty($SESSION->wantsurl)) {
     }
 }
 
+// Check if loginredirect is set in the SESSION.
+if ($errorcode && isset($SESSION->loginredirect)) {
+    $loginredirect = $SESSION->loginredirect;
+}
+$SESSION->loginredirect = $loginredirect;
+
 /// Redirect to alternative login URL if needed
-if (!empty($CFG->alternateloginurl)) {
+if (!empty($CFG->alternateloginurl) && $loginredirect) {
     $loginurl = new moodle_url($CFG->alternateloginurl);
 
     $loginurlstr = $loginurl->out(false);
@@ -366,7 +376,12 @@ if (!empty($SESSION->loginerrormsg) || !empty($SESSION->logininfomsg)) {
     if ($errormsg) {
         $SESSION->loginerrormsg = $errormsg;
     }
-    redirect(new moodle_url('/login/index.php'));
+
+    // Add redirect param to url.
+    $loginurl = new moodle_url('/login/index.php');
+    $loginurl->param('loginredirect', $SESSION->loginredirect);
+
+    redirect($loginurl->out(false));
 }
 
 $PAGE->set_title($loginsite);