Close redirect. Refs #100

coleifer · Mar 29, 2022 · ce82143 · ce82143
1 parent fcd4ac5
commit ce82143
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/sqlite_web/sqlite_web.py b/sqlite_web/sqlite_web.py
@@ -219,7 +219,10 @@ def table_create():
     table = (request.form.get('table_name') or '').strip()
     if not table:
         flash('Table name is required.', 'danger')
-        return redirect(request.form.get('redirect') or url_for('index'))
+        dest = request.form.get('redirect') or url_for('index')
+        if not dest.startswith('/'):
+            dest = '/' + dest
+        return redirect(dest)
 
     dataset[table]
     return redirect(url_for('table_import', table=table))

diff --git a/sqlite_web/templates/base.html b/sqlite_web/templates/base.html
@@ -38,7 +38,7 @@
           {% block content_header %}
             {% if not dataset.is_readonly %}
             <form action="{{ url_for('table_create') }}" class="form-inline float-right" method="post" style="margin-top: 10px;">
-              <input name="redirect" type="hidden" value="{{ request.path }}" />
+              <input name="redirect" type="hidden" value="{{ request.full_path }}" />{# full-path begins with "/" and includes querystring #}
               <input class="form-control form-control-sm" name="table_name" placeholder="new_table_name" />
               <button class="btn btn-primary btn-sm" type="submit">Create</button>
             </form>