Fix URL redirection from remote source

Fixes #1518

Author: ihalaij1

course/templates/course/_course_menu.html

@@ -188,7 +188,7 @@ <h4 class="course-menu-label">{% translate "COURSE_STAFF" %}</h4>
 
 {% if is_course_staff %}
 <li class="nav-item">
-	<a class="nav-link menu-pseudonymize" href="{% url 'toggle-pseudonymization' %}">
+	<a class="nav-link menu-pseudonymize" href="{% url 'toggle-pseudonymization' %}?next={{ request.get_full_path|urlencode }}">
 		{% if pseudonymize %}
 			<i class="bi-eye-fill" aria-hidden="true" data-bs-toggle="tooltip" data-bs-placement="right" title="{% translate "UNPSEUDONYMIZE" %}"></i>
 			<span class="course-menu-label">{% translate "UNPSEUDONYMIZE" %}</span>

exercise/templates/exercise/staff/_assessment_panel.html

@@ -31,6 +31,7 @@
 							{% for tag in submission.submission_taggings.all %}
 							<form method="post" action="{% url 'remove-tag-from-submissions' course_slug=course.url instance_slug=instance.url module_slug=module.url exercise_path=exercise.get_path submission_id=submission.id subtag_id=tag.tag.id %}">
 								{% csrf_token %}
+								<input type="hidden" name="next" value="{{ request.get_full_path|urlencode }}">
 								<div class="d-flex flex-nowrap align-items-center gap-1">
 									{{tag.tag|colortag:"size=sm"}}
 									<button type="submit" class="aplus-button--danger aplus-button--secondary aplus-button--xs"><i class="bi-x-lg" aria-hidden="true"></i></button>
@@ -40,7 +41,7 @@
 						</p>
 					</div>
 					<div class="d-flex flex-wrap justify-content-end align-items-center gap-2">
-						<div class="dropdown">
+						<div id="taggingsDropdown" class="dropdown" data-next-path="{{ request.get_full_path|urlencode }}">
 							<button class="aplus-button--secondary aplus-button--sm dropdown-toggle" type="button" id="dropdownMenuButton" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
 								{% translate 'ADD_TAGGING' %}
 							</button>
@@ -239,6 +240,16 @@
 	csrfInput.setAttribute('value', csrfToken);
 	form.appendChild(csrfInput);
 
+	// Read the next URL from a data attribute on the dropdown container
+	var next = document.querySelector('#taggingsDropdown')?.getAttribute('data-next-path');
+	if (next) {
+		var nextInput = document.createElement('input');
+		nextInput.setAttribute('type', 'hidden');
+		nextInput.setAttribute('name', 'next');
+		nextInput.setAttribute('value', next);
+		form.appendChild(nextInput);
+	}
+
 	form.submit();
 }
 

exercise/views.py

@@ -8,6 +8,7 @@
 from django.shortcuts import get_object_or_404, redirect
 from django.template.loader import render_to_string
 from django.utils.decorators import method_decorator
+from django.utils.http import url_has_allowed_host_and_scheme
 from django.utils.translation import gettext_lazy as _, get_language
 from django.utils.text import format_lazy
 from django.views.decorators.clickjacking import xframe_options_exempt
@@ -62,8 +63,10 @@ def post(self, request, *args, **kwargs):
         SubmissionTagging.objects.create(submission=submission, tag=subtag)
 
         # Redirect back to the previous page
-        return redirect(request.headers.get('referer', '/'))
-
+        next_url = request.POST.get('next')
+        if next_url and url_has_allowed_host_and_scheme(next_url, allowed_hosts=None):
+            return redirect(next_url)
+        return redirect('/')
 
 class SubmissionTaggingRemoveView(CourseInstanceBaseView):
     access_mode = ACCESS.ASSISTANT
@@ -80,7 +83,10 @@ def post(self, request, *args, **kwargs):
         SubmissionTagging.objects.filter(submission=submission, tag=subtag).delete()
 
         # Redirect back to the previous page
-        return redirect(request.headers.get('referer', '/'))
+        next_url = request.POST.get('next')
+        if next_url and url_has_allowed_host_and_scheme(next_url, allowed_hosts=None):
+            return redirect(next_url)
+        return redirect('/')
 
 
 class ExerciseInfoView(ExerciseBaseView):

userprofile/views.py

@@ -368,4 +368,9 @@ class PseudonymizeView(BaseView):
     def get(self, request: HttpRequest) -> HttpResponse:
         pseudonymize = request.session.get("pseudonymize", False)
         request.session["pseudonymize"] = not pseudonymize
-        return HttpResponseRedirect(request.headers.get("referer", "/"))
+
+        # Redirect back to the previous page
+        next_url = request.GET.get('next')
+        if next_url and url_has_allowed_host_and_scheme(next_url, allowed_hosts=None):
+            return HttpResponseRedirect(next_url)
+        return HttpResponseRedirect('/')