feat: redirect user to requested URL after successful altcha verification

Signed-off-by: Keshav Priyadarshi <git@keshav.space>

Author: keshav-space

vulnerabilities/middleware/altcha_protection.py

@@ -8,10 +8,13 @@
 #
 
 import time
+from urllib.parse import urlencode
 
 from django.shortcuts import redirect
 from django.utils.deprecation import MiddlewareMixin
 
+SESSION_TIMEOUT = 900  # 15 minutes
+
 
 class AltchaProtectionMiddleware(MiddlewareMixin):
     PROTECTED_PREFIXES = (
@@ -20,23 +23,23 @@ class AltchaProtectionMiddleware(MiddlewareMixin):
         "/advisories/",
         "/affected-by-advisories/v2/",
         "/fixing-advisories/v2/",
+        "/pipelines/",
     )
 
-    SESSION_TIMEOUT = 900  # 15 minutes
-
     def __call__(self, request):
         protected = any(request.path.startswith(prefix) for prefix in self.PROTECTED_PREFIXES)
 
         if not protected:
             return self.get_response(request)
 
         verified_at = request.session.get("altcha_verified_at")
+        next_url = request.get_full_path()
 
         if not verified_at:
-            return redirect(f"/altcha/")
+            return redirect(f"/altcha/?{urlencode({'next': next_url})}")
 
-        if time.time() - verified_at > self.SESSION_TIMEOUT:
+        if time.time() - verified_at > SESSION_TIMEOUT:
             request.session.pop("altcha_verified_at", None)
-            return redirect(f"/altcha/")
+            return redirect(f"/altcha/?{urlencode({'next': next_url})}")
 
         return self.get_response(request)

vulnerabilities/views.py

@@ -1167,4 +1167,6 @@ class AltchaView(FormView):
 
     def form_valid(self, form):
         self.request.session["altcha_verified_at"] = time.time()
-        return redirect("/")
+
+        next_url = self.request.GET.get("next", "/")
+        return redirect(next_url)