Fix open-redirect via next parameter, remove dead code

internal/web/auth_handlers.go

@@ -47,10 +47,7 @@ func (h *Web) handleLogin(w http.ResponseWriter, r *http.Request) {
 	}
 	_ = database.TouchLastLogin(h.DB, user.ID)
 
-	if next == "" || next[0] != '/' {
+	http.Redirect(w, r, safeRedirectPath(next), http.StatusFound)
-		next = "/"
-	}
-	http.Redirect(w, r, next, http.StatusFound)
 }
 
 func (h *Web) loginFailed(w http.ResponseWriter, r *http.Request, next string) {

internal/web/playlists.go

@@ -133,10 +133,7 @@ func (h *Web) setFavorite(w http.ResponseWriter, r *http.Request, star bool) {
 	}
 	itemType := r.FormValue("item_type")
 	itemID := r.FormValue("item_id")
-	next := r.FormValue("next")
+	next := safeRedirectPath(r.FormValue("next"))
-	if next == "" || next[0] != '/' {
-		next = "/"
-	}
 	switch itemType {
 	case "song", "album", "artist":
 	default:

internal/web/views.go

@@ -2,7 +2,6 @@ package web
 
 import (
 	"database/sql"
-	"time"
 
 	"git.noroutes.net/NoRoutes/vibetunes/internal/database"
 )
@@ -102,10 +101,3 @@ func albumOf(db *sql.DB, s *database.Song) *database.Album {
 	}
 	return album
 }
-
-type SessionView struct {
-	ID        string
-	UserAgent string
-	IPAddress string
-	CreatedAt time.Time
-}

internal/web/web.go

@@ -36,6 +36,17 @@ func (h *Web) page(w http.ResponseWriter, r *http.Request, name, active, title s
 	})
 }
 
+// safeRedirectPath returns next if it's a same-site relative path, or
+// "/" otherwise. Guards against open redirects: a bare "/foo" is fine,
+// but "//evil.com" or "https://evil.com" are protocol-relative/absolute
+// URLs a browser would follow off-site.
+func safeRedirectPath(next string) string {
+	if next == "" || next[0] != '/' || len(next) > 1 && next[1] == '/' {
+		return "/"
+	}
+	return next
+}
+
 func (h *Web) flash(w http.ResponseWriter, r *http.Request, name, active, title, flash, kind string, data any) {
 	render(w, name, PageData{
 		Active:    active,