And even more info hoping that I’ll eventually get some answer.
Using ExamDiff I compared various files involved in the login process between 2.0.0 and 2.0.4 versions.
I found the following changes in manager/controllers/default/security/login.php
from 2.0.0
$modx->smarty->assign('modahsh',$_REQUEST['modahsh']);
to 2.0.4
$hash = $modx->sanitizeString($_REQUEST['modahsh']);
$modx->smarty->assign('modahsh',$hash);
from 2.0.0
$modx->smarty->assign('returnUrl',$_SERVER['REQUEST_URI']);
to 2.0.4
$chars = array("'",'"','(',')',';','>','<','!');
$returnUrl = str_replace($chars,'',$_SERVER['REQUEST_URI']);
$modx->smarty->assign('returnUrl',$returnUrl);
from 2.0.0
} else {
$modx->smarty->assign('error_message',$modx->lexicon('login_cannot_locate_account'));
$validated = false;
to 2.0.4
*REMOVED*
from 2.0.0
$url = !empty($_POST['returnUrl']) ? $_POST['returnUrl'] : $modx->getOption('manager_url');
$modx->sendRedirect($url,'','','full');
to 2.0.4
$url = !empty($_POST['returnUrl']) ? $_POST['returnUrl'] : $modx->getOption('manager_url',null,MODX_MANAGER_PATH);
$modx->sendRedirect(rtrim($url,'/'),'','','full');
I tried replacing 2.0.4 login.php with the 2.0.0 version just in case it worked and I got "Recursion too deep; the stack overflowed."
Running out of ideas on this little bug...
MODX Staff