security

.env.example

@@ -1,3 +1,4 @@
+FLASK_ENV=production
 SECRET_KEY=replace-this-with-a-long-random-string
 DATABASE_URL=postgresql+psycopg://user:password@host/dbname
 APP_BASE_URL=https://myboker.org

app.py

@@ -1,11 +1,13 @@
 #!/usr/bin/env python3
 from __future__ import annotations
 
+import os
+
 import click
 from flask import Flask
 
 from auth import current_user_id, is_logged_in
-from config import Config
+from config import Config, ProductionConfig
 from db import database_extensions_available, db, init_database
 from extensions import csrf, limiter, mail
 from routes.account import account_bp
@@ -17,7 +19,8 @@ from utils import cents_to_dollars, safe_date_label
 
 def create_app(config_overrides: dict | None = None) -> Flask:
     app = Flask(__name__)
-    app.config.from_object(Config)
+    cfg = ProductionConfig if os.getenv("FLASK_ENV") == "production" else Config
+    app.config.from_object(cfg)
     if config_overrides:
         app.config.update(config_overrides)
 
@@ -60,4 +63,4 @@ def create_app(config_overrides: dict | None = None) -> Flask:
 app = create_app()
 
 if __name__ == "__main__":
-    app.run(debug=True)
+    app.run(debug=os.getenv("FLASK_DEBUG", "0") == "1")

routes/account.py

@@ -1,6 +1,8 @@
 #!/usr/bin/env python3
 from __future__ import annotations
 
+from urllib.parse import urlparse
+
 from flask import Blueprint, flash, redirect, render_template, request, url_for
 
 from auth import (
@@ -97,7 +99,9 @@ def login():
             flash("That account is disabled.", "error")
         else:
             log_user_in(user.id)
-            next_url = request.args.get("next") or url_for("leagues.index")
+            raw_next = request.args.get("next", "")
+            parsed = urlparse(raw_next)
+            next_url = raw_next if (raw_next and not parsed.netloc and not parsed.scheme) else url_for("leagues.index")
             flash("Logged in.", "success")
             return redirect(next_url)