06/02 Modified transaction, remember filtered criteria, page after editing a transaction
This commit is contained in:
@@ -188,6 +188,11 @@ def edit(id):
|
||||
form.account_id.data = str(txn.account_id)
|
||||
form.category_id.data = str(txn.category_id) if txn.category_id else ''
|
||||
|
||||
next_url = request.form.get('next') or request.args.get('next', '')
|
||||
# Only allow relative URLs to prevent open-redirect
|
||||
if not next_url.startswith('/'):
|
||||
next_url = ''
|
||||
|
||||
if form.validate_on_submit():
|
||||
old_account_id = txn.account_id
|
||||
txn.transaction_type = active_type
|
||||
@@ -204,12 +209,13 @@ def edit(id):
|
||||
if txn.transaction_type == 'expense':
|
||||
from app.services.alert_service import check_and_flash_budget_alerts
|
||||
check_and_flash_budget_alerts(flash)
|
||||
return redirect(url_for('transactions.index', tab=txn.transaction_type))
|
||||
return redirect(next_url or url_for('transactions.index', tab=txn.transaction_type))
|
||||
|
||||
return render_template('transactions/form.html',
|
||||
form=form,
|
||||
txn=txn,
|
||||
txn_type=active_type,
|
||||
next_url=next_url,
|
||||
income_cats=_category_choices_json('income'),
|
||||
expense_cats=_category_choices_json('expense'),
|
||||
title='Edit Transaction')
|
||||
|
||||
Reference in New Issue
Block a user