Bugfix

[pxsit]

Improves the handling of the next page redirection parameter in both the admin and contest handlers.
Fix #1684

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Improves safety and correctness of handling the next redirection parameter in admin and contest POST handlers to avoid unsafe redirects and better preserve allowed URLs. Fixes #1684.

Changes:

• Parse next using urllib.parse.urlsplit in both admin and contest handlers.
• Reject next values that include a scheme/host or don’t start with /, falling back to a safe URL.
• Preserve query strings for accepted internal paths.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
cms/server/contest/handlers/main.py	Uses urlsplit to validate/sanitize next and preserve query parameters for contest redirects.
cms/server/admin/handlers/main.py	Uses urlsplit to validate/sanitize next and preserve query parameters for admin redirects.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 16.66667% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 54.17%. Comparing base (66475db) to head (41aa0c9).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
cms/server/util.py	14.28%	12 Missing ⚠️
cms/server/admin/handlers/main.py	0.00%	2 Missing ⚠️
cms/server/contest/handlers/main.py	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1685      +/-   ##
==========================================
- Coverage   54.18%   54.17%   -0.02%     
==========================================
  Files         340      340              
  Lines       27835    27844       +9     
==========================================
+ Hits        15083    15085       +2     
- Misses      12752    12759       +7     

Flag	Coverage Δ
functionaltests	0.00% <0.00%> (ø)
unittests	54.17% <16.66%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[prandla]

there's a bunch of code that's duplicated between the CWS and AWS parts now. i'd suggest moving them into a helper function in cms/server/util.py.