04/28 Fixed bugs

routes/auth.py

@@ -7,6 +7,7 @@ Routes: /, /register, /login, /logout, /profile
 """
 from flask import Blueprint, render_template, request, redirect, flash, session, jsonify, url_for
 from datetime import datetime
+from urllib.parse import urlparse, urljoin
 import json
 
 from extensions import db, logger_handler
@@ -105,7 +106,11 @@ def login():
             if user and user.check_password(password):
                 # Check if "Remember Me" is checked
                 remember_me = request.form.get('remember_me') == 'on'
-                
+
+                # Invalidate the pre-login session to prevent session fixation attacks,
+                # then re-apply the remember_me permanence flag on the fresh session.
+                session.clear()
+
                 # Set session as permanent if "Remember Me" is checked
                 if remember_me:
                     session.permanent = True
@@ -143,9 +148,18 @@ def login():
                 flash(f'Welcome back, {user.full_name}!', 'success')
                 logger_handler.logger.info(f"User {user.username} (ID: {user.id}) logged in successfully")
 
-                # Redirect to intended page or dashboard
+                # Redirect to intended page or dashboard.
+                # Validate next is a relative path on this host to prevent open-redirect attacks.
+                def _is_safe_url(target):
+                    ref_url  = urlparse(request.host_url)
+                    test_url = urlparse(urljoin(request.host_url, target))
+                    return (test_url.scheme in ('http', 'https')
+                            and ref_url.netloc == test_url.netloc)
+
                 next_page = request.args.get('next')
-                return redirect(next_page) if next_page else redirect(url_for('attendance.attendance_report'))
+                if next_page and _is_safe_url(next_page):
+                    return redirect(next_page)
+                return redirect(url_for('attendance.attendance_report'))
 
             else:
                 # Invalid credentials - log failed attempt