added url check

app/utils.py

@@ -6,6 +6,7 @@ from typing import cast
 from itsdangerous import BadSignature, URLSafeSerializer
 from xkcdpass import xkcd_password
 from functools import wraps, lru_cache
+from urllib.parse import urlparse, urljoin
 
 from .models import Deck, InfoBanner, Token, db, Course
 
@@ -209,3 +210,13 @@ def get_cached_deck_info(token_id, course_folder, deck_slug):
         "deck_name": deck_obj.name,
         "index_file": deck_obj.index_file
     }
+
+def is_safe_url(target):
+    """
+    Ensures that a redirect target will lead to the same server.
+    Handles both relative paths ('/admin') and absolute URLs ('https://yourdomain.com/admin').
+    """
+    ref_url = urlparse(request.host_url)
+    test_url = urlparse(urljoin(request.host_url, target))
+    
+    return test_url.scheme in ('http', 'https') and ref_url.netloc == test_url.netloc