UrlHelper::dir() always returns a trailing slash, so the session cookie was
scoped to "/kanboard/". That cookie is not sent back for "/kanboard", which
is exactly the url the bundled web.config and .htaccess serve the application
on: both rewrite to index.php whenever the request is not a file, so the
directory url is never redirected to its trailing-slash form.
The first login then stores redirectAfterLogin="/kanboard", redirects there
after a successful check, arrives without the session cookie and bounces back
to the login form with no error message.
Use the directory without the trailing slash, which is what the browser would
have picked as the default cookie path anyway and still matches every url
below it.
An AccessDeniedException raised by a single request was relayed out of the
batch loop, so the whole call answered with one error object instead of the
array of responses required by the JSON-RPC spec. Authentication failures
still fail the whole call.
Fixes#3879
upstream
dualfroz