Updated functionalities 2

app/routes/auth.py

@@ -1,7 +1,7 @@
 from flask import Blueprint, render_template, redirect, url_for, flash, request, abort
 from flask_login import login_user, logout_user, login_required, current_user
 from urllib.parse import urlparse
-from app import db
+from app import db, limiter
 from app.models.user import User
 from app.utils.forms import LoginForm, UserForm, ProfileForm
 from app.utils.decorators import admin_required, supervisor_required
@@ -30,6 +30,7 @@ def _safe_next(next_url: str | None) -> str:
 
 
 @bp.route('/login', methods=['GET', 'POST'])
+@limiter.limit('20 per minute; 5 per second')
 def login():
     if current_user.is_authenticated:
         return redirect(url_for('dashboard.index'))
@@ -254,7 +255,7 @@ def toggle_active(user_id):
         f'account {action_label} by {current_user.username}',
     )
     flash(f'User {user.username} has been {action_label}.', 'success')
-    return redirect(request.referrer or url_for('auth.list_users'))
+    return redirect(_safe_next(request.referrer) or url_for('auth.list_users'))
 
 # ── Notification Matrix ───────────────────────────────────────────────────────