From 3f52d6ee33ddd03bed7fb3552930bc3f290687c8 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Fri, 23 Dec 2022 21:34:53 +0100
Subject: [PATCH 1/8] Add hidden "next" input set to current path

---
 .../snippets/reading_modals/finish_reading_modal.html         | 3 ++-
 .../snippets/reading_modals/progress_update_modal.html        | 1 +
 .../snippets/reading_modals/start_reading_modal.html          | 3 ++-
 .../templates/snippets/reading_modals/stop_reading_modal.html | 1 +
 .../templates/snippets/reading_modals/want_to_read_modal.html | 3 ++-
 bookwyrm/templates/snippets/shelf_selector.html               | 4 +++-
 bookwyrm/templates/snippets/shelve_button/modal_button.html   | 1 +
 .../shelve_button/shelve_button_dropdown_options.html         | 2 ++
 .../snippets/shelve_button/shelve_button_options.html         | 1 +
 9 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html b/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html
index fe35ee7e6..e79f0c5a3 100644
--- a/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html
@@ -13,7 +13,8 @@ Finish "<em>{{ book_title }}</em>"
 {% csrf_token %}
 <input type="hidden" name="id" value="{{ readthrough.id }}">
 <input type="hidden" name="reading_status" value="read">
-<input type="hidden" name="shelf" value="{{ move_from }}"> 
+<input type="hidden" name="shelf" value="{{ move_from }}">
+<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html b/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html
index e0be1588d..06dacda69 100644
--- a/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html
@@ -11,6 +11,7 @@
 {% csrf_token %}
 <input type="hidden" name="id" value="{{ readthrough.id }}">
 <input type="hidden" name="start_date" value="{{ readthrough.start_date|date:'Y-m-d' }}">
+<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html b/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html
index 861f118f9..00962d7f8 100644
--- a/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html
@@ -10,9 +10,10 @@ Start "<em>{{ book_title }}</em>"
 
 {% block modal-form-open %}
 <form name="start-reading-{{ uuid }}" action="{% url 'reading-status' 'start' book.id %}" method="post" {% if not refresh %}class="submit-status"{% endif %}>
+{% csrf_token %}
 <input type="hidden" name="reading_status" value="reading">
 <input type="hidden" name="shelf" value="{{ move_from }}">
-{% csrf_token %}
+<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html b/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html
index 8e5ae7d65..37718134b 100644
--- a/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html
@@ -14,6 +14,7 @@ Stop Reading "<em>{{ book_title }}</em>"
 <input type="hidden" name="id" value="{{ readthrough.id }}">
 <input type="hidden" name="reading_status" value="stopped-reading">
 <input type="hidden" name="shelf" value="{{ move_from }}">
+<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html b/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html
index d6bc4d70a..f16c6d44a 100644
--- a/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html
@@ -10,9 +10,10 @@ Want to Read "<em>{{ book_title }}</em>"
 
 {% block modal-form-open %}
 <form name="want-to-read-{{ uuid }}" action="{% url 'reading-status' 'want' book.id %}" method="post" {% if not refresh %}class="submit-status"{% endif %}>
+{% csrf_token %}
 <input type="hidden" name="reading_status" value="to-read">
 <input type="hidden" name="shelf" value="{{ move_from }}"> 
-{% csrf_token %}
+<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block form %}
diff --git a/bookwyrm/templates/snippets/shelf_selector.html b/bookwyrm/templates/snippets/shelf_selector.html
index feea50d7b..c13c726e7 100644
--- a/bookwyrm/templates/snippets/shelf_selector.html
+++ b/bookwyrm/templates/snippets/shelf_selector.html
@@ -22,7 +22,7 @@
         <input type="hidden" name="book" value="{{ book.id }}">
         <input type="hidden" name="change-shelf-from" value="{{ current.identifier }}">
         <input type="hidden" name="shelf" value="{{ shelf.identifier }}">
-
+        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small shelf-option is-radiusless has-background-body" type="submit" {% if shelf.identifier == current.identifier %}disabled{% endif %}>
             <span>
                 {% include "snippets/translated_shelf_name.html" with shelf=shelf %}
@@ -78,6 +78,7 @@
         {% csrf_token %}
         <input type="hidden" name="book" value="{{ book.id }}">
         <input type="hidden" name="shelf" value="{{ user_shelf.id }}">
+        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small is-radiusless is-danger is-light" type="submit">
             {% blocktrans with name=user_shelf|translate_shelf_name %}Remove from {{ name }}{% endblocktrans %}
         </button>
@@ -92,6 +93,7 @@
         {% csrf_token %}
         <input type="hidden" name="book" value="{{ book.id }}">
         <input type="hidden" name="shelf" value="{{ shelf.id }}">
+        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small is-radiusless is-danger is-light" type="submit">{% trans "Remove from" %} {{ shelf.name }}</button>
     </form>
 </li>
diff --git a/bookwyrm/templates/snippets/shelve_button/modal_button.html b/bookwyrm/templates/snippets/shelve_button/modal_button.html
index a745b4fba..ef37f8872 100644
--- a/bookwyrm/templates/snippets/shelve_button/modal_button.html
+++ b/bookwyrm/templates/snippets/shelve_button/modal_button.html
@@ -1,5 +1,6 @@
 {% load utilities %}
 <form name="fallback_form_{{ 0|uuid }}" method="GET" action="{{ fallback_url }}" autocomplete="off">
+    <input type="hidden" name="next" value="{{ request.path }}">
     <button
         type="submit"
         class="button {{ class }}"
diff --git a/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html b/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html
index 73381558c..c6a334180 100644
--- a/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html
+++ b/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html
@@ -45,6 +45,7 @@
             <form name="shelve-{{ uuid }}-{{ shelf.identifier }}" action="/shelve/" method="post" autocomplete="off">
                 {% csrf_token %}
                 <input type="hidden" name="book" value="{{ active_shelf.book.id }}">
+                <input type="hidden" name="next" value="{{ request.path }}">
                 <button class="button {{ class }}" name="shelf" type="submit" value="{{ shelf.identifier }}" {% if book|is_book_on_shelf:shelf %} disabled {% endif %}>
                     <span>{{ shelf.name }}</span>
                 </button>
@@ -69,6 +70,7 @@
         {% csrf_token %}
         <input type="hidden" name="book" value="{{ active_shelf.book.id }}">
         <input type="hidden" name="shelf" value="{{ active_shelf.shelf.id }}">
+        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small{% if dropdown %} is-radiusless{% endif %} is-danger is-light" type="submit">
             {% blocktrans with name=active_shelf.shelf|translate_shelf_name %}Remove from {{ name }}{% endblocktrans %}
         </button>
diff --git a/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html b/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html
index 53ff80bf7..e254d46c3 100644
--- a/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html
+++ b/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html
@@ -62,6 +62,7 @@
         <form name="shelve-{{ uuid }}-{{ shelf.identifier }}" action="/shelve/" method="post">
             {% csrf_token %}
             <input type="hidden" name="book" value="{{ active_shelf.book.id }}">
+            <input type="hidden" name="next" value="{{ request.path }}">
             <button
                 class="button {{ class }}"
                 name="shelf"

From f5a79dfa826e1f61227f22c34ba0d8479cd33642 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Fri, 23 Dec 2022 21:35:28 +0100
Subject: [PATCH 2/8] Redirect to "next" value in view

---
 bookwyrm/views/reading.py             |  5 +++--
 bookwyrm/views/shelf/shelf_actions.py | 12 ++++++++----
 bookwyrm/views/status.py              |  8 +++++---
 3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/bookwyrm/views/reading.py b/bookwyrm/views/reading.py
index 328dfd7fa..d49ae30f7 100644
--- a/bookwyrm/views/reading.py
+++ b/bookwyrm/views/reading.py
@@ -42,6 +42,7 @@ class ReadingStatus(View):
     @transaction.atomic
     def post(self, request, status, book_id):
         """Change the state of a book by shelving it and adding reading dates"""
+        next_step = request.POST.get("next", "/")
         identifier = {
             "want": models.Shelf.TO_READ,
             "start": models.Shelf.READING,
@@ -83,7 +84,7 @@ class ReadingStatus(View):
             if current_status_shelfbook.shelf.identifier != desired_shelf.identifier:
                 current_status_shelfbook.delete()
             else:  # It already was on the shelf
-                return redirect("/")
+                return redirect(next_step)
 
         models.ShelfBook.objects.create(
             book=book, shelf=desired_shelf, user=request.user
@@ -121,7 +122,7 @@ class ReadingStatus(View):
         if is_api_request(request):
             return HttpResponse()
 
-        return redirect("/")
+        return redirect(next_step)
 
 
 @method_decorator(login_required, name="dispatch")
diff --git a/bookwyrm/views/shelf/shelf_actions.py b/bookwyrm/views/shelf/shelf_actions.py
index d2aa7d566..62bad3111 100644
--- a/bookwyrm/views/shelf/shelf_actions.py
+++ b/bookwyrm/views/shelf/shelf_actions.py
@@ -35,6 +35,7 @@ def delete_shelf(request, shelf_id):
 @transaction.atomic
 def shelve(request):
     """put a book on a user's shelf"""
+    next_step = request.POST.get("next", "/")
     book = get_object_or_404(models.Edition, id=request.POST.get("book"))
     desired_shelf = get_object_or_404(
         request.user.shelf_set, identifier=request.POST.get("shelf")
@@ -64,13 +65,14 @@ def shelve(request):
             .first()
         )
         if current_read_status_shelfbook is not None:
+            # If it is not already on the shelf
             if (
                 current_read_status_shelfbook.shelf.identifier
                 != desired_shelf.identifier
             ):
                 current_read_status_shelfbook.delete()
-            else:  # It is already on the shelf
-                return redirect("/")
+            else:
+                return redirect(next_step)
 
         # create the new shelf-book entry
         models.ShelfBook.objects.create(
@@ -86,13 +88,15 @@ def shelve(request):
         # Might be good to alert, or reject the action?
         except IntegrityError:
             pass
-    return redirect("/")
+
+    return redirect(next_step)
 
 
 @login_required
 @require_POST
 def unshelve(request, book_id=False):
     """remove a book from a user's shelf"""
+    next_step = request.POST.get("next", "/")
     identity = book_id if book_id else request.POST.get("book")
     book = get_object_or_404(models.Edition, id=identity)
     shelf_book = get_object_or_404(
@@ -100,4 +104,4 @@ def unshelve(request, book_id=False):
     )
     shelf_book.raise_not_deletable(request.user)
     shelf_book.delete()
-    return redirect("/")
+    return redirect(next_step)
diff --git a/bookwyrm/views/status.py b/bookwyrm/views/status.py
index 42f903c05..c29413816 100644
--- a/bookwyrm/views/status.py
+++ b/bookwyrm/views/status.py
@@ -58,6 +58,7 @@ class CreateStatus(View):
     # pylint: disable=too-many-branches
     def post(self, request, status_type, existing_status_id=None):
         """create status of whatever type"""
+        next_step = request.POST.get("next", "/")
         created = not existing_status_id
         existing_status = None
         if existing_status_id:
@@ -80,7 +81,7 @@ class CreateStatus(View):
             if is_api_request(request):
                 logger.exception(form.errors)
                 return HttpResponseBadRequest()
-            return redirect("/")
+            return redirect(next_step)
 
         status = form.save(request, commit=False)
         status.ready = False
@@ -134,7 +135,7 @@ class CreateStatus(View):
 
         if is_api_request(request):
             return HttpResponse()
-        return redirect("/")
+        return redirect(next_step)
 
 
 @method_decorator(login_required, name="dispatch")
@@ -167,6 +168,7 @@ def update_progress(request, book_id):  # pylint: disable=unused-argument
 def edit_readthrough(request):
     """can't use the form because the dates are too finnicky"""
     # TODO: remove this, it duplicates the code in the ReadThrough view
+    next_step = request.POST.get("next", "/")
     readthrough = get_object_or_404(models.ReadThrough, id=request.POST.get("id"))
 
     readthrough.start_date = load_date_in_user_tz_as_utc(
@@ -198,7 +200,7 @@ def edit_readthrough(request):
 
     if is_api_request(request):
         return HttpResponse()
-    return redirect("/")
+    return redirect(next_step)
 
 
 def find_mentions(user, content):

From bfe04feca9ea9e9b3a66a2861d2f37e1568c0896 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Fri, 30 Dec 2022 17:55:47 +0100
Subject: [PATCH 3/8] Add validation util + test

---
 bookwyrm/tests/test_utils.py | 18 ++++++++++++++++++
 bookwyrm/utils/validate.py   | 16 ++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 bookwyrm/utils/validate.py

diff --git a/bookwyrm/tests/test_utils.py b/bookwyrm/tests/test_utils.py
index 183548975..60f3185e6 100644
--- a/bookwyrm/tests/test_utils.py
+++ b/bookwyrm/tests/test_utils.py
@@ -3,6 +3,7 @@ import re
 from django.test import TestCase
 
 from bookwyrm.utils import regex
+from bookwyrm.utils.validate import validate_url_domain
 
 
 class TestUtils(TestCase):
@@ -11,3 +12,20 @@ class TestUtils(TestCase):
     def test_regex(self):
         """Regexes used throughout the app"""
         self.assertTrue(re.match(regex.DOMAIN, "xn--69aa8bzb.xn--y9a3aq"))
+
+    def test_valid_url_domain(self):
+        """Check with a valid URL"""
+        self.assertEqual(
+            validate_url_domain("https://your.domain.here/legit-book-url/"),
+            "https://your.domain.here/legit-book-url/",
+        )
+
+    def test_invalid_url_domain(self):
+        """Check with an invalid URL"""
+        self.assertEqual(
+            validate_url_domain("https://up-to-no-good.tld/bad-actor.exe"), "/"
+        )
+
+    def test_default_url_domain(self):
+        """Check with a default URL"""
+        self.assertEqual(validate_url_domain("/"), "/")
diff --git a/bookwyrm/utils/validate.py b/bookwyrm/utils/validate.py
new file mode 100644
index 000000000..0c0f01f06
--- /dev/null
+++ b/bookwyrm/utils/validate.py
@@ -0,0 +1,16 @@
+"""Validations"""
+from bookwyrm.settings import DOMAIN, USE_HTTPS
+
+
+def validate_url_domain(url, default="/"):
+    """Basic check that the URL starts with the instance domain name"""
+    if url in ("/", default):
+        return url
+
+    protocol = "https://" if USE_HTTPS else "http://"
+    origin = f"{protocol}{DOMAIN}"
+
+    if url.startswith(origin):
+        return url
+
+    return default

From 78c214a6d40c0dbd06c361c09df6efcd2798a644 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Fri, 30 Dec 2022 17:56:25 +0100
Subject: [PATCH 4/8] Add validation before using url

---
 bookwyrm/views/reading.py             | 2 ++
 bookwyrm/views/shelf/shelf_actions.py | 3 +++
 bookwyrm/views/status.py              | 3 +++
 3 files changed, 8 insertions(+)

diff --git a/bookwyrm/views/reading.py b/bookwyrm/views/reading.py
index d49ae30f7..5b7efc50a 100644
--- a/bookwyrm/views/reading.py
+++ b/bookwyrm/views/reading.py
@@ -12,6 +12,7 @@ from django.views.decorators.http import require_POST
 
 from bookwyrm import forms, models
 from bookwyrm.views.shelf.shelf_actions import unshelve
+from bookwyrm.utils.validate import validate_url_domain
 from .status import CreateStatus
 from .helpers import get_edition, handle_reading_status, is_api_request
 from .helpers import load_date_in_user_tz_as_utc
@@ -43,6 +44,7 @@ class ReadingStatus(View):
     def post(self, request, status, book_id):
         """Change the state of a book by shelving it and adding reading dates"""
         next_step = request.POST.get("next", "/")
+        next_step = validate_url_domain(next_step, "/")
         identifier = {
             "want": models.Shelf.TO_READ,
             "start": models.Shelf.READING,
diff --git a/bookwyrm/views/shelf/shelf_actions.py b/bookwyrm/views/shelf/shelf_actions.py
index 62bad3111..97fec52fb 100644
--- a/bookwyrm/views/shelf/shelf_actions.py
+++ b/bookwyrm/views/shelf/shelf_actions.py
@@ -3,6 +3,7 @@ from django.db import IntegrityError, transaction
 from django.contrib.auth.decorators import login_required
 from django.shortcuts import get_object_or_404, redirect
 from django.views.decorators.http import require_POST
+from bookwyrm.utils.validate import validate_url_domain
 
 from bookwyrm import forms, models
 
@@ -36,6 +37,7 @@ def delete_shelf(request, shelf_id):
 def shelve(request):
     """put a book on a user's shelf"""
     next_step = request.POST.get("next", "/")
+    next_step = validate_url_domain(next_step, "/")
     book = get_object_or_404(models.Edition, id=request.POST.get("book"))
     desired_shelf = get_object_or_404(
         request.user.shelf_set, identifier=request.POST.get("shelf")
@@ -97,6 +99,7 @@ def shelve(request):
 def unshelve(request, book_id=False):
     """remove a book from a user's shelf"""
     next_step = request.POST.get("next", "/")
+    next_step = validate_url_domain(next_step, "/")
     identity = book_id if book_id else request.POST.get("book")
     book = get_object_or_404(models.Edition, id=identity)
     shelf_book = get_object_or_404(
diff --git a/bookwyrm/views/status.py b/bookwyrm/views/status.py
index c29413816..a86f658bc 100644
--- a/bookwyrm/views/status.py
+++ b/bookwyrm/views/status.py
@@ -18,6 +18,7 @@ from django.views.decorators.http import require_POST
 from markdown import markdown
 from bookwyrm import forms, models
 from bookwyrm.utils import regex, sanitizer
+from bookwyrm.utils.validate import validate_url_domain
 from .helpers import handle_remote_webfinger, is_api_request
 from .helpers import load_date_in_user_tz_as_utc
 
@@ -59,6 +60,7 @@ class CreateStatus(View):
     def post(self, request, status_type, existing_status_id=None):
         """create status of whatever type"""
         next_step = request.POST.get("next", "/")
+        next_step = validate_url_domain(next_step, "/")
         created = not existing_status_id
         existing_status = None
         if existing_status_id:
@@ -169,6 +171,7 @@ def edit_readthrough(request):
     """can't use the form because the dates are too finnicky"""
     # TODO: remove this, it duplicates the code in the ReadThrough view
     next_step = request.POST.get("next", "/")
+    next_step = validate_url_domain(next_step, "/")
     readthrough = get_object_or_404(models.ReadThrough, id=request.POST.get("id"))
 
     readthrough.start_date = load_date_in_user_tz_as_utc(

From f266c71da92096921729697f6a218408f1c0f9df Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Sun, 1 Jan 2023 19:42:03 +0100
Subject: [PATCH 5/8] Replace hidden field with HTTP Referrer value

---
 .../snippets/reading_modals/finish_reading_modal.html         | 1 -
 .../snippets/reading_modals/progress_update_modal.html        | 1 -
 .../snippets/reading_modals/start_reading_modal.html          | 1 -
 .../templates/snippets/reading_modals/stop_reading_modal.html | 1 -
 .../templates/snippets/reading_modals/want_to_read_modal.html | 1 -
 bookwyrm/templates/snippets/shelf_selector.html               | 3 ---
 bookwyrm/templates/snippets/shelve_button/modal_button.html   | 1 -
 .../shelve_button/shelve_button_dropdown_options.html         | 2 --
 .../snippets/shelve_button/shelve_button_options.html         | 1 -
 bookwyrm/views/reading.py                                     | 2 +-
 bookwyrm/views/shelf/shelf_actions.py                         | 4 ++--
 bookwyrm/views/status.py                                      | 4 ++--
 12 files changed, 5 insertions(+), 17 deletions(-)

diff --git a/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html b/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html
index e79f0c5a3..ee720e448 100644
--- a/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html
@@ -14,7 +14,6 @@ Finish "<em>{{ book_title }}</em>"
 <input type="hidden" name="id" value="{{ readthrough.id }}">
 <input type="hidden" name="reading_status" value="read">
 <input type="hidden" name="shelf" value="{{ move_from }}">
-<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html b/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html
index 06dacda69..e0be1588d 100644
--- a/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html
@@ -11,7 +11,6 @@
 {% csrf_token %}
 <input type="hidden" name="id" value="{{ readthrough.id }}">
 <input type="hidden" name="start_date" value="{{ readthrough.start_date|date:'Y-m-d' }}">
-<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html b/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html
index 00962d7f8..d8331a281 100644
--- a/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html
@@ -13,7 +13,6 @@ Start "<em>{{ book_title }}</em>"
 {% csrf_token %}
 <input type="hidden" name="reading_status" value="reading">
 <input type="hidden" name="shelf" value="{{ move_from }}">
-<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html b/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html
index 37718134b..8e5ae7d65 100644
--- a/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html
@@ -14,7 +14,6 @@ Stop Reading "<em>{{ book_title }}</em>"
 <input type="hidden" name="id" value="{{ readthrough.id }}">
 <input type="hidden" name="reading_status" value="stopped-reading">
 <input type="hidden" name="shelf" value="{{ move_from }}">
-<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html b/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html
index f16c6d44a..80d67f79e 100644
--- a/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html
@@ -13,7 +13,6 @@ Want to Read "<em>{{ book_title }}</em>"
 {% csrf_token %}
 <input type="hidden" name="reading_status" value="to-read">
 <input type="hidden" name="shelf" value="{{ move_from }}"> 
-<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block form %}
diff --git a/bookwyrm/templates/snippets/shelf_selector.html b/bookwyrm/templates/snippets/shelf_selector.html
index c13c726e7..902a66196 100644
--- a/bookwyrm/templates/snippets/shelf_selector.html
+++ b/bookwyrm/templates/snippets/shelf_selector.html
@@ -22,7 +22,6 @@
         <input type="hidden" name="book" value="{{ book.id }}">
         <input type="hidden" name="change-shelf-from" value="{{ current.identifier }}">
         <input type="hidden" name="shelf" value="{{ shelf.identifier }}">
-        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small shelf-option is-radiusless has-background-body" type="submit" {% if shelf.identifier == current.identifier %}disabled{% endif %}>
             <span>
                 {% include "snippets/translated_shelf_name.html" with shelf=shelf %}
@@ -78,7 +77,6 @@
         {% csrf_token %}
         <input type="hidden" name="book" value="{{ book.id }}">
         <input type="hidden" name="shelf" value="{{ user_shelf.id }}">
-        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small is-radiusless is-danger is-light" type="submit">
             {% blocktrans with name=user_shelf|translate_shelf_name %}Remove from {{ name }}{% endblocktrans %}
         </button>
@@ -93,7 +91,6 @@
         {% csrf_token %}
         <input type="hidden" name="book" value="{{ book.id }}">
         <input type="hidden" name="shelf" value="{{ shelf.id }}">
-        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small is-radiusless is-danger is-light" type="submit">{% trans "Remove from" %} {{ shelf.name }}</button>
     </form>
 </li>
diff --git a/bookwyrm/templates/snippets/shelve_button/modal_button.html b/bookwyrm/templates/snippets/shelve_button/modal_button.html
index ef37f8872..a745b4fba 100644
--- a/bookwyrm/templates/snippets/shelve_button/modal_button.html
+++ b/bookwyrm/templates/snippets/shelve_button/modal_button.html
@@ -1,6 +1,5 @@
 {% load utilities %}
 <form name="fallback_form_{{ 0|uuid }}" method="GET" action="{{ fallback_url }}" autocomplete="off">
-    <input type="hidden" name="next" value="{{ request.path }}">
     <button
         type="submit"
         class="button {{ class }}"
diff --git a/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html b/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html
index c6a334180..73381558c 100644
--- a/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html
+++ b/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html
@@ -45,7 +45,6 @@
             <form name="shelve-{{ uuid }}-{{ shelf.identifier }}" action="/shelve/" method="post" autocomplete="off">
                 {% csrf_token %}
                 <input type="hidden" name="book" value="{{ active_shelf.book.id }}">
-                <input type="hidden" name="next" value="{{ request.path }}">
                 <button class="button {{ class }}" name="shelf" type="submit" value="{{ shelf.identifier }}" {% if book|is_book_on_shelf:shelf %} disabled {% endif %}>
                     <span>{{ shelf.name }}</span>
                 </button>
@@ -70,7 +69,6 @@
         {% csrf_token %}
         <input type="hidden" name="book" value="{{ active_shelf.book.id }}">
         <input type="hidden" name="shelf" value="{{ active_shelf.shelf.id }}">
-        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small{% if dropdown %} is-radiusless{% endif %} is-danger is-light" type="submit">
             {% blocktrans with name=active_shelf.shelf|translate_shelf_name %}Remove from {{ name }}{% endblocktrans %}
         </button>
diff --git a/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html b/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html
index e254d46c3..53ff80bf7 100644
--- a/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html
+++ b/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html
@@ -62,7 +62,6 @@
         <form name="shelve-{{ uuid }}-{{ shelf.identifier }}" action="/shelve/" method="post">
             {% csrf_token %}
             <input type="hidden" name="book" value="{{ active_shelf.book.id }}">
-            <input type="hidden" name="next" value="{{ request.path }}">
             <button
                 class="button {{ class }}"
                 name="shelf"
diff --git a/bookwyrm/views/reading.py b/bookwyrm/views/reading.py
index 5b7efc50a..587c0d8d9 100644
--- a/bookwyrm/views/reading.py
+++ b/bookwyrm/views/reading.py
@@ -43,7 +43,7 @@ class ReadingStatus(View):
     @transaction.atomic
     def post(self, request, status, book_id):
         """Change the state of a book by shelving it and adding reading dates"""
-        next_step = request.POST.get("next", "/")
+        next_step = request.META.get('HTTP_REFERER')
         next_step = validate_url_domain(next_step, "/")
         identifier = {
             "want": models.Shelf.TO_READ,
diff --git a/bookwyrm/views/shelf/shelf_actions.py b/bookwyrm/views/shelf/shelf_actions.py
index 97fec52fb..da86cc853 100644
--- a/bookwyrm/views/shelf/shelf_actions.py
+++ b/bookwyrm/views/shelf/shelf_actions.py
@@ -36,7 +36,7 @@ def delete_shelf(request, shelf_id):
 @transaction.atomic
 def shelve(request):
     """put a book on a user's shelf"""
-    next_step = request.POST.get("next", "/")
+    next_step = request.META.get('HTTP_REFERER')
     next_step = validate_url_domain(next_step, "/")
     book = get_object_or_404(models.Edition, id=request.POST.get("book"))
     desired_shelf = get_object_or_404(
@@ -98,7 +98,7 @@ def shelve(request):
 @require_POST
 def unshelve(request, book_id=False):
     """remove a book from a user's shelf"""
-    next_step = request.POST.get("next", "/")
+    next_step = request.META.get('HTTP_REFERER')
     next_step = validate_url_domain(next_step, "/")
     identity = book_id if book_id else request.POST.get("book")
     book = get_object_or_404(models.Edition, id=identity)
diff --git a/bookwyrm/views/status.py b/bookwyrm/views/status.py
index a86f658bc..f703f8b77 100644
--- a/bookwyrm/views/status.py
+++ b/bookwyrm/views/status.py
@@ -59,7 +59,7 @@ class CreateStatus(View):
     # pylint: disable=too-many-branches
     def post(self, request, status_type, existing_status_id=None):
         """create status of whatever type"""
-        next_step = request.POST.get("next", "/")
+        next_step = request.META.get('HTTP_REFERER')
         next_step = validate_url_domain(next_step, "/")
         created = not existing_status_id
         existing_status = None
@@ -170,7 +170,7 @@ def update_progress(request, book_id):  # pylint: disable=unused-argument
 def edit_readthrough(request):
     """can't use the form because the dates are too finnicky"""
     # TODO: remove this, it duplicates the code in the ReadThrough view
-    next_step = request.POST.get("next", "/")
+    next_step = request.META.get('HTTP_REFERER')
     next_step = validate_url_domain(next_step, "/")
     readthrough = get_object_or_404(models.ReadThrough, id=request.POST.get("id"))
 

From bc19d7c658036de3ecd0df3d4388ff5b727d7ba0 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Sun, 1 Jan 2023 19:45:12 +0100
Subject: [PATCH 6/8] Black

---
 bookwyrm/views/reading.py             | 2 +-
 bookwyrm/views/shelf/shelf_actions.py | 4 ++--
 bookwyrm/views/status.py              | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/bookwyrm/views/reading.py b/bookwyrm/views/reading.py
index 587c0d8d9..42e8d560a 100644
--- a/bookwyrm/views/reading.py
+++ b/bookwyrm/views/reading.py
@@ -43,7 +43,7 @@ class ReadingStatus(View):
     @transaction.atomic
     def post(self, request, status, book_id):
         """Change the state of a book by shelving it and adding reading dates"""
-        next_step = request.META.get('HTTP_REFERER')
+        next_step = request.META.get("HTTP_REFERER")
         next_step = validate_url_domain(next_step, "/")
         identifier = {
             "want": models.Shelf.TO_READ,
diff --git a/bookwyrm/views/shelf/shelf_actions.py b/bookwyrm/views/shelf/shelf_actions.py
index da86cc853..b597bd35f 100644
--- a/bookwyrm/views/shelf/shelf_actions.py
+++ b/bookwyrm/views/shelf/shelf_actions.py
@@ -36,7 +36,7 @@ def delete_shelf(request, shelf_id):
 @transaction.atomic
 def shelve(request):
     """put a book on a user's shelf"""
-    next_step = request.META.get('HTTP_REFERER')
+    next_step = request.META.get("HTTP_REFERER")
     next_step = validate_url_domain(next_step, "/")
     book = get_object_or_404(models.Edition, id=request.POST.get("book"))
     desired_shelf = get_object_or_404(
@@ -98,7 +98,7 @@ def shelve(request):
 @require_POST
 def unshelve(request, book_id=False):
     """remove a book from a user's shelf"""
-    next_step = request.META.get('HTTP_REFERER')
+    next_step = request.META.get("HTTP_REFERER")
     next_step = validate_url_domain(next_step, "/")
     identity = book_id if book_id else request.POST.get("book")
     book = get_object_or_404(models.Edition, id=identity)
diff --git a/bookwyrm/views/status.py b/bookwyrm/views/status.py
index f703f8b77..52f547cdd 100644
--- a/bookwyrm/views/status.py
+++ b/bookwyrm/views/status.py
@@ -59,7 +59,7 @@ class CreateStatus(View):
     # pylint: disable=too-many-branches
     def post(self, request, status_type, existing_status_id=None):
         """create status of whatever type"""
-        next_step = request.META.get('HTTP_REFERER')
+        next_step = request.META.get("HTTP_REFERER")
         next_step = validate_url_domain(next_step, "/")
         created = not existing_status_id
         existing_status = None
@@ -170,7 +170,7 @@ def update_progress(request, book_id):  # pylint: disable=unused-argument
 def edit_readthrough(request):
     """can't use the form because the dates are too finnicky"""
     # TODO: remove this, it duplicates the code in the ReadThrough view
-    next_step = request.META.get('HTTP_REFERER')
+    next_step = request.META.get("HTTP_REFERER")
     next_step = validate_url_domain(next_step, "/")
     readthrough = get_object_or_404(models.ReadThrough, id=request.POST.get("id"))
 

From ac2ef667aff282e8273c92ec339a011d41c51aa2 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Sun, 1 Jan 2023 19:57:10 +0100
Subject: [PATCH 7/8] Fix error when no referer

---
 bookwyrm/utils/validate.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bookwyrm/utils/validate.py b/bookwyrm/utils/validate.py
index 0c0f01f06..a6272319b 100644
--- a/bookwyrm/utils/validate.py
+++ b/bookwyrm/utils/validate.py
@@ -4,7 +4,7 @@ from bookwyrm.settings import DOMAIN, USE_HTTPS
 
 def validate_url_domain(url, default="/"):
     """Basic check that the URL starts with the instance domain name"""
-    if url in ("/", default):
+    if url in ("/", default, None):
         return url
 
     protocol = "https://" if USE_HTTPS else "http://"

From fa3edea87b9dc23ae6c714aa3f42cb26b6023d8d Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Sun, 1 Jan 2023 20:51:23 +0100
Subject: [PATCH 8/8] Update validate.py

---
 bookwyrm/utils/validate.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bookwyrm/utils/validate.py b/bookwyrm/utils/validate.py
index a6272319b..89aee4782 100644
--- a/bookwyrm/utils/validate.py
+++ b/bookwyrm/utils/validate.py
@@ -4,7 +4,10 @@ from bookwyrm.settings import DOMAIN, USE_HTTPS
 
 def validate_url_domain(url, default="/"):
     """Basic check that the URL starts with the instance domain name"""
-    if url in ("/", default, None):
+    if not url:
+        return default
+
+    if url in ("/", default):
         return url
 
     protocol = "https://" if USE_HTTPS else "http://"