From ac278065d2f0d7d79a9eac7662854d6fcd57e030 Mon Sep 17 00:00:00 2001
From: SowinskiBraeden <braeden@sowinski.dev>
Date: Wed, 24 Jun 2026 19:08:33 -0700
Subject: [PATCH] security

---
 .env.example      | 1 +
 app.py            | 9 ++++++---
 routes/account.py | 6 +++++-
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.env.example b/.env.example
index b73c996..5fd77fe 100644
--- a/.env.example
+++ b/.env.example
@@ -1,3 +1,4 @@
+FLASK_ENV=production
 SECRET_KEY=replace-this-with-a-long-random-string
 DATABASE_URL=postgresql+psycopg://user:password@host/dbname
 APP_BASE_URL=https://myboker.org
diff --git a/app.py b/app.py
index b0164e7..c2c707b 100644
--- a/app.py
+++ b/app.py
@@ -1,11 +1,13 @@
 #!/usr/bin/env python3
 from __future__ import annotations
 
+import os
+
 import click
 from flask import Flask
 
 from auth import current_user_id, is_logged_in
-from config import Config
+from config import Config, ProductionConfig
 from db import database_extensions_available, db, init_database
 from extensions import csrf, limiter, mail
 from routes.account import account_bp
@@ -17,7 +19,8 @@ from utils import cents_to_dollars, safe_date_label
 
 def create_app(config_overrides: dict | None = None) -> Flask:
     app = Flask(__name__)
-    app.config.from_object(Config)
+    cfg = ProductionConfig if os.getenv("FLASK_ENV") == "production" else Config
+    app.config.from_object(cfg)
     if config_overrides:
         app.config.update(config_overrides)
 
@@ -60,4 +63,4 @@ def create_app(config_overrides: dict | None = None) -> Flask:
 app = create_app()
 
 if __name__ == "__main__":
-    app.run(debug=True)
+    app.run(debug=os.getenv("FLASK_DEBUG", "0") == "1")
diff --git a/routes/account.py b/routes/account.py
index 1bd77c0..ba0f5ec 100644
--- a/routes/account.py
+++ b/routes/account.py
@@ -1,6 +1,8 @@
 #!/usr/bin/env python3
 from __future__ import annotations
 
+from urllib.parse import urlparse
+
 from flask import Blueprint, flash, redirect, render_template, request, url_for
 
 from auth import (
@@ -97,7 +99,9 @@ def login():
             flash("That account is disabled.", "error")
         else:
             log_user_in(user.id)
-            next_url = request.args.get("next") or url_for("leagues.index")
+            raw_next = request.args.get("next", "")
+            parsed = urlparse(raw_next)
+            next_url = raw_next if (raw_next and not parsed.netloc and not parsed.scheme) else url_for("leagues.index")
             flash("Logged in.", "success")
             return redirect(next_url)