Avoid index.php duplication in security redirects

This change addresses environments where internal URL rewriting (e.g., via mod_rewrite) is unavailable, forcing the index.php entry point or script name to remain visible in the request path.

When this 'dirty' absolute path is stored as a target for later redirection, Symfony's logic may prepend the script name again, resulting in duplication (e.g., /index.php/index.php/). Switching to an absolute URL (including scheme and host) prevents this re-processing.

Fixes #1645

Author: Dominic-Mayers

src/Controller/SecurityController.php

@@ -16,6 +16,7 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
 use Symfony\Component\Security\Http\Attribute\CurrentUser;
 use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
 use Symfony\Component\Security\Http\Util\TargetPathTrait;
@@ -50,7 +51,7 @@ public function login(
         // page, after a successful login you are redirected to a page in the previous
         // locale. This code regenerates the referrer URL whenever the login page is
         // browsed, to ensure that its locale is always the current one.
-        $this->saveTargetPath($request->getSession(), 'main', $this->generateUrl('admin_index'));
+        $this->saveTargetPath($request->getSession(), 'main', $this->generateUrl('admin_index', [], UrlGeneratorInterface::ABSOLUTE_URL));
 
         return $this->render('security/login.html.twig', [
             // last username entered by the user (if any)