Introduction

I am not a 100% sure this is really an issue with Joomla but seeing as it does not appear in 1.7 but in 2.5 and the issue occurs in a default Joomla plugin, I figure this is the best way to go.

System

Short info about the Joomla system I am using:
I have deployed a live system that currently uses Joomla 1.7.5 while I have a developement system with version 2.5.8.
The main possible conflict here may be JFusion, but the problem should occur with everything that sets the return variable on login.

The site has two languages: German and English, while English is the default.

Issue

The issue only appears when I try to log in while the site is set to German.

When I log in to the site, the languagefilter plugin's onUserLogin function is executed. Because the automatic_change setting is set to 1, it traverses down the code tree unti it hits line ~411:

if (isset($associations[$lang_code]) && $menu->getItem($associations[$lang_code])) {
    $itemid = $associations[$lang_code];
    $app->setUserState('users.login.form.return', 'index.php?&Itemid='.$itemid);
}
else
{
    $itemid = isset($homes[$lang_code]) ? $homes[$lang_code]->id : $homes['*']->id;
    $app->setUserState('users.login.form.return', 'index.php?&Itemid='.$itemid);
}

Here, the following happens: Because $associations[$lang_code] is set, the users.login.form.return state is set to a new value. Looking this up in the code, it takes the active menu item (which is the login page) and looks for the right language to redirect to. Of course, since the login is successful, the login page itself is not accessible anymore. Thus, a 403 occurs.

A second thing I noticed here is the else branch (that I didn't enter here). Maybe I am wrong, but I don't see the $homes variable being initialized anywhere. Do I miss something here? This is not part of the actual issue, but maybe somebody wants to take a look at it while they are working on the file.

Solution?

If I see the code right, what happens is that it just overwrites any prior defined return URL, effictively disabling the feature in this particular situation.

In my opinion it should rather check the current value (if one is set) and fetch those associations. Then it should adjust the URL according to the associated page in the correct language. If no value was set, then the current way seems okay.

Associated Commit

If I see it correctly, this new feature was introduced cb122dd on 2012-03-09.