Fix some issues

app/routes/auth.py

@@ -1,8 +1,9 @@
 import logging
 from datetime import datetime
+from urllib.parse import urlparse, urljoin
 from flask import Blueprint, render_template, redirect, url_for, flash, request
 from flask_login import login_user, logout_user, login_required, current_user
-from app import db
+from app import db, limiter
 from app.models import User, UserRole
 from app.services.log_service import log_action
 
@@ -10,7 +11,23 @@ auth_bp = Blueprint('auth', __name__, url_prefix='/auth')
 logger  = logging.getLogger(__name__)
 
 
+def _is_safe_url(target):
+    """Return True only when *target* points back to this same host.
+
+    Prevents open-redirect attacks where an attacker crafts a login URL
+    with ?next=https://evil.com — without this check the user would be
+    silently forwarded to an external site after authentication.
+    """
+    ref_url  = urlparse(request.host_url)
+    test_url = urlparse(urljoin(request.host_url, target))
+    return (
+        test_url.scheme in ('http', 'https') and
+        ref_url.netloc == test_url.netloc
+    )
+
+
 @auth_bp.route('/login', methods=['GET', 'POST'])
+@limiter.limit('10 per minute; 50 per hour')
 def login():
     if current_user.is_authenticated:
         return redirect(url_for('tickets.dashboard'))
@@ -24,10 +41,13 @@ def login():
         if user and user.check_password(password) and user.is_active:
             login_user(user, remember=remember)
             user.last_login = datetime.utcnow()
-            db.session.commit()
             log_action(user.id, 'user_login', 'user', user.id, f'email={email}')
+            db.session.commit()
             logger.info(f'[AUTH LOGIN] user_id={user.id} email={email}')
             next_page = request.args.get('next')
+            if next_page and not _is_safe_url(next_page):
+                logger.warning(f'[AUTH OPEN-REDIRECT BLOCKED] next={next_page} user_id={user.id}')
+                next_page = None
             return redirect(next_page or url_for('tickets.dashboard'))
         else:
             logger.warning(f'[AUTH FAILED] email={email} ip={request.remote_addr}')
@@ -37,6 +57,7 @@ def login():
 
 
 @auth_bp.route('/register', methods=['GET', 'POST'])
+@limiter.limit('5 per minute; 20 per hour')
 def register():
     if current_user.is_authenticated:
         return redirect(url_for('tickets.dashboard'))
@@ -69,8 +90,8 @@ def register():
             )
             user.set_password(password)
             db.session.add(user)
-            db.session.commit()
             log_action(user.id, 'user_register', 'user', user.id, f'email={email}')
+            db.session.commit()
             logger.info(f'[AUTH REGISTER] user_id={user.id} email={email}')
             flash('Account created! You may now log in.', 'success')
             return redirect(url_for('auth.login'))
@@ -116,8 +137,8 @@ def profile():
             current_user.set_password(new_pw)
             logger.info(f'[AUTH PASSWORD CHANGE] user_id={current_user.id}')
 
-        db.session.commit()
         log_action(current_user.id, 'user_profile_update', 'user', current_user.id)
+        db.session.commit()
         logger.info(f'[AUTH PROFILE UPDATE] user_id={current_user.id}')
         flash('Profile updated successfully.', 'success')