Many views redirect when finished - e.g. login. verify, and many others. the query param ?next is always properly handled. A next field in a form is also looked at - however many of the views don't have the next field.
Make sure any form used in a view that redirects has the optional nextformmixin.
At first glance for example - the /verify and /us-verify are missing it. The older /login, /register DO have it.
Also - the forms that DON'T have it, aren't calling validate_redirect_url which can offer nicer errors to the client.
Also2 - consider unescaping values that come from the form - since Werkzeug is unescaping values that are set in the query params.
Many views redirect when finished - e.g. login. verify, and many others. the query param ?next is always properly handled. A next field in a form is also looked at - however many of the views don't have the next field.
Make sure any form used in a view that redirects has the optional nextformmixin.
At first glance for example - the /verify and /us-verify are missing it. The older /login, /register DO have it.
Also - the forms that DON'T have it, aren't calling validate_redirect_url which can offer nicer errors to the client.
Also2 - consider unescaping values that come from the form - since Werkzeug is unescaping values that are set in the query params.