06/15 Fix issues

app/utils/__init__.py

@@ -1,10 +1,21 @@
-"""RBAC decorators. Never trust the client; gate on server side."""
+"""RBAC decorators and shared request utilities."""
 from functools import wraps
-from flask import abort
+from urllib.parse import urlparse
+from flask import abort, request
 from flask_login import current_user
 from app.models.enums import Role
 
 
+def safe_referrer(fallback: str) -> str:
+    """Return request.referrer only when it is same-origin; else fallback."""
+    ref = request.referrer
+    if ref:
+        parsed = urlparse(ref)
+        if parsed.netloc in ("", request.host):
+            return ref
+    return fallback
+
+
 def role_required(*roles):
     """Require the current user to hold one of the given roles."""
     def decorator(fn):