06/02 Modified transaction, remember filtered criteria, page after editing a transaction

app/routes/transactions.py

@@ -188,6 +188,11 @@ def edit(id):
         form.account_id.data = str(txn.account_id)
         form.category_id.data = str(txn.category_id) if txn.category_id else ''
 
+    next_url = request.form.get('next') or request.args.get('next', '')
+    # Only allow relative URLs to prevent open-redirect
+    if not next_url.startswith('/'):
+        next_url = ''
+
     if form.validate_on_submit():
         old_account_id = txn.account_id
         txn.transaction_type = active_type
@@ -204,12 +209,13 @@ def edit(id):
         if txn.transaction_type == 'expense':
             from app.services.alert_service import check_and_flash_budget_alerts
             check_and_flash_budget_alerts(flash)
-        return redirect(url_for('transactions.index', tab=txn.transaction_type))
+        return redirect(next_url or url_for('transactions.index', tab=txn.transaction_type))
 
     return render_template('transactions/form.html',
                            form=form,
                            txn=txn,
                            txn_type=active_type,
+                           next_url=next_url,
                            income_cats=_category_choices_json('income'),
                            expense_cats=_category_choices_json('expense'),
                            title='Edit Transaction')

app/templates/transactions/form.html

@@ -61,6 +61,7 @@
     <form method="POST" novalidate id="txnForm">
         {{ form.hidden_tag() }}
         {{ form.transaction_type() }}
+        <input type="hidden" name="next" value="{{ next_url or '' }}">
 
         <!-- Type toggle — only for income/expense (not transfer) -->
         <div class="mb-3">

app/templates/transactions/index.html

@@ -94,7 +94,7 @@
                 {% if txn.transaction_type=='income' %}+{% else %}-{% endif %}{{ txn.amount | currency }}
             </td>
             <td class="text-end" style="padding-right:20px;white-space:nowrap;">
-                <a href="{{ url_for('transactions.edit', id=txn.id) }}" class="btn btn-sm btn-outline-secondary" style="font-size:11px;padding:2px 8px;">Edit</a>
+                <a href="{{ url_for('transactions.edit', id=txn.id, next=request.full_path) }}" class="btn btn-sm btn-outline-secondary" style="font-size:11px;padding:2px 8px;">Edit</a>
                 <form method="POST" action="{{ url_for('transactions.delete', id=txn.id) }}" style="display:inline;" onsubmit="return confirm('Delete this transaction?')">
                     <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                     <button type="submit" class="btn btn-sm btn-outline-danger ms-1" style="font-size:11px;padding:2px 8px;">Del</button>