Fix home button routes and login redirects

users/tests.py

@@ -69,6 +69,43 @@ class UserAuthFlowTests(TestCase):
         self.assertRedirects(response, reverse("users:profile"))
         self.assertEqual(int(self.client.session["_auth_user_id"]), user.pk)
 
+    def test_login_redirects_to_safe_next_url(self):
+        user = User.objects.create_user(
+            username="cart-user",
+            email="cart-user@example.com",
+            password="StrongPassword123",
+            is_active=True,
+        )
+        next_url = reverse("orders:cart")
+
+        response = self.client.post(
+            f"{reverse('users:login')}?next={next_url}",
+            data={"email": "cart-user@example.com", "password": "StrongPassword123", "next": next_url},
+        )
+
+        self.assertRedirects(response, next_url)
+        self.assertEqual(int(self.client.session["_auth_user_id"]), user.pk)
+
+    def test_login_ignores_unsafe_next_url(self):
+        user = User.objects.create_user(
+            username="safe-user",
+            email="safe-user@example.com",
+            password="StrongPassword123",
+            is_active=True,
+        )
+
+        response = self.client.post(
+            f"{reverse('users:login')}?next=https://example.com/phishing",
+            data={
+                "email": "safe-user@example.com",
+                "password": "StrongPassword123",
+                "next": "https://example.com/phishing",
+            },
+        )
+
+        self.assertRedirects(response, reverse("users:profile"))
+        self.assertEqual(int(self.client.session["_auth_user_id"]), user.pk)
+
     def test_login_with_email_works_when_username_differs(self):
         user = User.objects.create_user(
             username="oleg-old",

users/views.py

@@ -11,7 +11,7 @@ from django.contrib.auth.views import (
 from django.shortcuts import redirect, render
 from django.urls import reverse_lazy
 from django.utils.encoding import force_str
-from django.utils.http import urlsafe_base64_decode
+from django.utils.http import url_has_allowed_host_and_scheme, urlsafe_base64_decode
 from django.views.decorators.http import require_http_methods
 
 from users.forms import LoginForm, ProfileForm, RegisterForm, SantehRayPasswordResetForm, SantehRaySetPasswordForm
@@ -22,17 +22,30 @@ User = get_user_model()
 
 
 # Create your views here.
+def _get_safe_next_url(request):
+    next_url = request.POST.get("next") or request.GET.get("next")
+    if next_url and url_has_allowed_host_and_scheme(
+        url=next_url,
+        allowed_hosts={request.get_host()},
+        require_https=request.is_secure(),
+    ):
+        return next_url
+
+    return None
+
+
 @require_http_methods(["GET", "POST"])
 def login(request):
+    next_url = _get_safe_next_url(request)
     if request.user.is_authenticated:
-        return redirect("users:profile")
+        return redirect(next_url or "users:profile")
 
     form = LoginForm(request=request, data=request.POST or None)
     if request.method == "POST" and form.is_valid():
         auth_login(request, form.get_user())
-        return redirect("users:profile")
+        return redirect(next_url or "users:profile")
 
-    return render(request, "users/login.html", context={"form": form})
+    return render(request, "users/login.html", context={"form": form, "next_url": next_url})
 
 
 @require_http_methods(["GET", "POST"])