Bugfix

[pxsit]

Improves the handling of the next page redirection parameter in both the admin and contest handlers.
Fix #1684

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Improves safety and correctness of handling the next redirection parameter in admin and contest POST handlers to avoid unsafe redirects and better preserve allowed URLs. Fixes #1684.

Changes:

• Parse next using urllib.parse.urlsplit in both admin and contest handlers.
• Reject next values that include a scheme/host or don’t start with /, falling back to a safe URL.
• Preserve query strings for accepted internal paths.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
cms/server/contest/handlers/main.py	Uses urlsplit to validate/sanitize next and preserve query parameters for contest redirects.
cms/server/admin/handlers/main.py	Uses urlsplit to validate/sanitize next and preserve query parameters for admin redirects.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 3.57143% with 27 lines in your changes missing coverage. Please review.
✅ Project coverage is 54.64%. Comparing base (779f9ff) to head (46800cd).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
cms/server/admin/handlers/main.py	0.00%	14 Missing ⚠️
cms/server/contest/handlers/main.py	7.14%	13 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1685      +/-   ##
==========================================
- Coverage   54.68%   54.64%   -0.05%     
==========================================
  Files         336      336              
  Lines       27501    27525      +24     
==========================================
+ Hits        15039    15041       +2     
- Misses      12462    12484      +22     

Flag	Coverage Δ
functionaltests	0.00% <0.00%> (ø)
unittests	54.64% <3.57%> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.