From 3f52d6ee33ddd03bed7fb3552930bc3f290687c8 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Fri, 23 Dec 2022 21:34:53 +0100
Subject: [PATCH 01/19] Add hidden "next" input set to current path

---
 .../snippets/reading_modals/finish_reading_modal.html         | 3 ++-
 .../snippets/reading_modals/progress_update_modal.html        | 1 +
 .../snippets/reading_modals/start_reading_modal.html          | 3 ++-
 .../templates/snippets/reading_modals/stop_reading_modal.html | 1 +
 .../templates/snippets/reading_modals/want_to_read_modal.html | 3 ++-
 bookwyrm/templates/snippets/shelf_selector.html               | 4 +++-
 bookwyrm/templates/snippets/shelve_button/modal_button.html   | 1 +
 .../shelve_button/shelve_button_dropdown_options.html         | 2 ++
 .../snippets/shelve_button/shelve_button_options.html         | 1 +
 9 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html b/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html
index fe35ee7e6..e79f0c5a3 100644
--- a/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html
@@ -13,7 +13,8 @@ Finish "<em>{{ book_title }}</em>"
 {% csrf_token %}
 <input type="hidden" name="id" value="{{ readthrough.id }}">
 <input type="hidden" name="reading_status" value="read">
-<input type="hidden" name="shelf" value="{{ move_from }}"> 
+<input type="hidden" name="shelf" value="{{ move_from }}">
+<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html b/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html
index e0be1588d..06dacda69 100644
--- a/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html
@@ -11,6 +11,7 @@
 {% csrf_token %}
 <input type="hidden" name="id" value="{{ readthrough.id }}">
 <input type="hidden" name="start_date" value="{{ readthrough.start_date|date:'Y-m-d' }}">
+<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html b/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html
index 861f118f9..00962d7f8 100644
--- a/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html
@@ -10,9 +10,10 @@ Start "<em>{{ book_title }}</em>"
 
 {% block modal-form-open %}
 <form name="start-reading-{{ uuid }}" action="{% url 'reading-status' 'start' book.id %}" method="post" {% if not refresh %}class="submit-status"{% endif %}>
+{% csrf_token %}
 <input type="hidden" name="reading_status" value="reading">
 <input type="hidden" name="shelf" value="{{ move_from }}">
-{% csrf_token %}
+<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html b/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html
index 8e5ae7d65..37718134b 100644
--- a/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html
@@ -14,6 +14,7 @@ Stop Reading "<em>{{ book_title }}</em>"
 <input type="hidden" name="id" value="{{ readthrough.id }}">
 <input type="hidden" name="reading_status" value="stopped-reading">
 <input type="hidden" name="shelf" value="{{ move_from }}">
+<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html b/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html
index d6bc4d70a..f16c6d44a 100644
--- a/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html
@@ -10,9 +10,10 @@ Want to Read "<em>{{ book_title }}</em>"
 
 {% block modal-form-open %}
 <form name="want-to-read-{{ uuid }}" action="{% url 'reading-status' 'want' book.id %}" method="post" {% if not refresh %}class="submit-status"{% endif %}>
+{% csrf_token %}
 <input type="hidden" name="reading_status" value="to-read">
 <input type="hidden" name="shelf" value="{{ move_from }}"> 
-{% csrf_token %}
+<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block form %}
diff --git a/bookwyrm/templates/snippets/shelf_selector.html b/bookwyrm/templates/snippets/shelf_selector.html
index feea50d7b..c13c726e7 100644
--- a/bookwyrm/templates/snippets/shelf_selector.html
+++ b/bookwyrm/templates/snippets/shelf_selector.html
@@ -22,7 +22,7 @@
         <input type="hidden" name="book" value="{{ book.id }}">
         <input type="hidden" name="change-shelf-from" value="{{ current.identifier }}">
         <input type="hidden" name="shelf" value="{{ shelf.identifier }}">
-
+        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small shelf-option is-radiusless has-background-body" type="submit" {% if shelf.identifier == current.identifier %}disabled{% endif %}>
             <span>
                 {% include "snippets/translated_shelf_name.html" with shelf=shelf %}
@@ -78,6 +78,7 @@
         {% csrf_token %}
         <input type="hidden" name="book" value="{{ book.id }}">
         <input type="hidden" name="shelf" value="{{ user_shelf.id }}">
+        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small is-radiusless is-danger is-light" type="submit">
             {% blocktrans with name=user_shelf|translate_shelf_name %}Remove from {{ name }}{% endblocktrans %}
         </button>
@@ -92,6 +93,7 @@
         {% csrf_token %}
         <input type="hidden" name="book" value="{{ book.id }}">
         <input type="hidden" name="shelf" value="{{ shelf.id }}">
+        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small is-radiusless is-danger is-light" type="submit">{% trans "Remove from" %} {{ shelf.name }}</button>
     </form>
 </li>
diff --git a/bookwyrm/templates/snippets/shelve_button/modal_button.html b/bookwyrm/templates/snippets/shelve_button/modal_button.html
index a745b4fba..ef37f8872 100644
--- a/bookwyrm/templates/snippets/shelve_button/modal_button.html
+++ b/bookwyrm/templates/snippets/shelve_button/modal_button.html
@@ -1,5 +1,6 @@
 {% load utilities %}
 <form name="fallback_form_{{ 0|uuid }}" method="GET" action="{{ fallback_url }}" autocomplete="off">
+    <input type="hidden" name="next" value="{{ request.path }}">
     <button
         type="submit"
         class="button {{ class }}"
diff --git a/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html b/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html
index 73381558c..c6a334180 100644
--- a/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html
+++ b/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html
@@ -45,6 +45,7 @@
             <form name="shelve-{{ uuid }}-{{ shelf.identifier }}" action="/shelve/" method="post" autocomplete="off">
                 {% csrf_token %}
                 <input type="hidden" name="book" value="{{ active_shelf.book.id }}">
+                <input type="hidden" name="next" value="{{ request.path }}">
                 <button class="button {{ class }}" name="shelf" type="submit" value="{{ shelf.identifier }}" {% if book|is_book_on_shelf:shelf %} disabled {% endif %}>
                     <span>{{ shelf.name }}</span>
                 </button>
@@ -69,6 +70,7 @@
         {% csrf_token %}
         <input type="hidden" name="book" value="{{ active_shelf.book.id }}">
         <input type="hidden" name="shelf" value="{{ active_shelf.shelf.id }}">
+        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small{% if dropdown %} is-radiusless{% endif %} is-danger is-light" type="submit">
             {% blocktrans with name=active_shelf.shelf|translate_shelf_name %}Remove from {{ name }}{% endblocktrans %}
         </button>
diff --git a/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html b/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html
index 53ff80bf7..e254d46c3 100644
--- a/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html
+++ b/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html
@@ -62,6 +62,7 @@
         <form name="shelve-{{ uuid }}-{{ shelf.identifier }}" action="/shelve/" method="post">
             {% csrf_token %}
             <input type="hidden" name="book" value="{{ active_shelf.book.id }}">
+            <input type="hidden" name="next" value="{{ request.path }}">
             <button
                 class="button {{ class }}"
                 name="shelf"

From f5a79dfa826e1f61227f22c34ba0d8479cd33642 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Fri, 23 Dec 2022 21:35:28 +0100
Subject: [PATCH 02/19] Redirect to "next" value in view

---
 bookwyrm/views/reading.py             |  5 +++--
 bookwyrm/views/shelf/shelf_actions.py | 12 ++++++++----
 bookwyrm/views/status.py              |  8 +++++---
 3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/bookwyrm/views/reading.py b/bookwyrm/views/reading.py
index 328dfd7fa..d49ae30f7 100644
--- a/bookwyrm/views/reading.py
+++ b/bookwyrm/views/reading.py
@@ -42,6 +42,7 @@ class ReadingStatus(View):
     @transaction.atomic
     def post(self, request, status, book_id):
         """Change the state of a book by shelving it and adding reading dates"""
+        next_step = request.POST.get("next", "/")
         identifier = {
             "want": models.Shelf.TO_READ,
             "start": models.Shelf.READING,
@@ -83,7 +84,7 @@ class ReadingStatus(View):
             if current_status_shelfbook.shelf.identifier != desired_shelf.identifier:
                 current_status_shelfbook.delete()
             else:  # It already was on the shelf
-                return redirect("/")
+                return redirect(next_step)
 
         models.ShelfBook.objects.create(
             book=book, shelf=desired_shelf, user=request.user
@@ -121,7 +122,7 @@ class ReadingStatus(View):
         if is_api_request(request):
             return HttpResponse()
 
-        return redirect("/")
+        return redirect(next_step)
 
 
 @method_decorator(login_required, name="dispatch")
diff --git a/bookwyrm/views/shelf/shelf_actions.py b/bookwyrm/views/shelf/shelf_actions.py
index d2aa7d566..62bad3111 100644
--- a/bookwyrm/views/shelf/shelf_actions.py
+++ b/bookwyrm/views/shelf/shelf_actions.py
@@ -35,6 +35,7 @@ def delete_shelf(request, shelf_id):
 @transaction.atomic
 def shelve(request):
     """put a book on a user's shelf"""
+    next_step = request.POST.get("next", "/")
     book = get_object_or_404(models.Edition, id=request.POST.get("book"))
     desired_shelf = get_object_or_404(
         request.user.shelf_set, identifier=request.POST.get("shelf")
@@ -64,13 +65,14 @@ def shelve(request):
             .first()
         )
         if current_read_status_shelfbook is not None:
+            # If it is not already on the shelf
             if (
                 current_read_status_shelfbook.shelf.identifier
                 != desired_shelf.identifier
             ):
                 current_read_status_shelfbook.delete()
-            else:  # It is already on the shelf
-                return redirect("/")
+            else:
+                return redirect(next_step)
 
         # create the new shelf-book entry
         models.ShelfBook.objects.create(
@@ -86,13 +88,15 @@ def shelve(request):
         # Might be good to alert, or reject the action?
         except IntegrityError:
             pass
-    return redirect("/")
+
+    return redirect(next_step)
 
 
 @login_required
 @require_POST
 def unshelve(request, book_id=False):
     """remove a book from a user's shelf"""
+    next_step = request.POST.get("next", "/")
     identity = book_id if book_id else request.POST.get("book")
     book = get_object_or_404(models.Edition, id=identity)
     shelf_book = get_object_or_404(
@@ -100,4 +104,4 @@ def unshelve(request, book_id=False):
     )
     shelf_book.raise_not_deletable(request.user)
     shelf_book.delete()
-    return redirect("/")
+    return redirect(next_step)
diff --git a/bookwyrm/views/status.py b/bookwyrm/views/status.py
index 42f903c05..c29413816 100644
--- a/bookwyrm/views/status.py
+++ b/bookwyrm/views/status.py
@@ -58,6 +58,7 @@ class CreateStatus(View):
     # pylint: disable=too-many-branches
     def post(self, request, status_type, existing_status_id=None):
         """create status of whatever type"""
+        next_step = request.POST.get("next", "/")
         created = not existing_status_id
         existing_status = None
         if existing_status_id:
@@ -80,7 +81,7 @@ class CreateStatus(View):
             if is_api_request(request):
                 logger.exception(form.errors)
                 return HttpResponseBadRequest()
-            return redirect("/")
+            return redirect(next_step)
 
         status = form.save(request, commit=False)
         status.ready = False
@@ -134,7 +135,7 @@ class CreateStatus(View):
 
         if is_api_request(request):
             return HttpResponse()
-        return redirect("/")
+        return redirect(next_step)
 
 
 @method_decorator(login_required, name="dispatch")
@@ -167,6 +168,7 @@ def update_progress(request, book_id):  # pylint: disable=unused-argument
 def edit_readthrough(request):
     """can't use the form because the dates are too finnicky"""
     # TODO: remove this, it duplicates the code in the ReadThrough view
+    next_step = request.POST.get("next", "/")
     readthrough = get_object_or_404(models.ReadThrough, id=request.POST.get("id"))
 
     readthrough.start_date = load_date_in_user_tz_as_utc(
@@ -198,7 +200,7 @@ def edit_readthrough(request):
 
     if is_api_request(request):
         return HttpResponse()
-    return redirect("/")
+    return redirect(next_step)
 
 
 def find_mentions(user, content):

From 8441314e7c4b730dbb08a1af7110025ced869478 Mon Sep 17 00:00:00 2001
From: Arie van Deursen <arie.vandeursen@tudelft.nl>
Date: Mon, 26 Dec 2022 14:23:19 +0100
Subject: [PATCH 03/19] Enable thumbnail generation in example environment

This makes the example environment more similar to the
setting in the django-tests.yml GitHub workflow.

It also ensures thumbnail generation is tested by default.
---
 .env.example | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index bbd825a9a..91d0d5896 100644
--- a/.env.example
+++ b/.env.example
@@ -60,7 +60,7 @@ SEARCH_TIMEOUT=5
 QUERY_TIMEOUT=5
 
 # Thumbnails Generation
-ENABLE_THUMBNAIL_GENERATION=false
+ENABLE_THUMBNAIL_GENERATION=true
 
 # S3 configuration
 USE_S3=false

From 1c0a3a78297b29ba24da0cca36132387ce21ba35 Mon Sep 17 00:00:00 2001
From: Arie van Deursen <arie.vandeursen@tudelft.nl>
Date: Mon, 26 Dec 2022 14:26:23 +0100
Subject: [PATCH 04/19] Only test thumbnails if they're enabled in the settings

---
 bookwyrm/tests/models/test_book_model.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/bookwyrm/tests/models/test_book_model.py b/bookwyrm/tests/models/test_book_model.py
index 5a2a6c3b6..ea73ab442 100644
--- a/bookwyrm/tests/models/test_book_model.py
+++ b/bookwyrm/tests/models/test_book_model.py
@@ -2,6 +2,8 @@
 from io import BytesIO
 import pathlib
 
+import pytest
+
 from dateutil.parser import parse
 from PIL import Image
 from django.core.files.base import ContentFile
@@ -10,7 +12,7 @@ from django.utils import timezone
 
 from bookwyrm import models, settings
 from bookwyrm.models.book import isbn_10_to_13, isbn_13_to_10
-
+from bookwyrm.settings import ENABLE_THUMBNAIL_GENERATION
 
 class Book(TestCase):
     """not too much going on in the books model but here we are"""
@@ -101,6 +103,10 @@ class Book(TestCase):
         self.first_edition.save()
         self.assertEqual(self.first_edition.edition_rank, 1)
 
+    @pytest.mark.skipif(
+        not ENABLE_THUMBNAIL_GENERATION,
+        reason="Thumbnail generation disabled in settings"
+    )
     def test_thumbnail_fields(self):
         """Just hit them"""
         image_file = pathlib.Path(__file__).parent.joinpath(

From 5d63b483283c207d0f4160f982ff814f380fe7d9 Mon Sep 17 00:00:00 2001
From: Arie van Deursen <arie.vandeursen@tudelft.nl>
Date: Mon, 26 Dec 2022 14:27:46 +0100
Subject: [PATCH 05/19] Fix postgres to version 13 in Docker compose

Helps to make tests reproducible, and avoids accidentally
relying on postgres:11 in which some tests fail.
---
 docker-compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index e98128544..4ab7a1c34 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -15,7 +15,7 @@ services:
       - static_volume:/app/static
       - media_volume:/app/images
   db:
-    image: postgres
+    image: postgres:13
     env_file: .env
     volumes:
       - pgdata:/var/lib/postgresql/data

From 2d76595af6f432b1060095a0f2c57aac378e1e8c Mon Sep 17 00:00:00 2001
From: Jascha Urbach <jascha@jascha.wtf>
Date: Wed, 28 Dec 2022 15:41:48 +0100
Subject: [PATCH 06/19] Add Website field to author

Authors have Websites. that might be interesting for BookWyrm users. Now there is a field specify the website of an author and it is shown tu users under the wikipedia link

Adds max char for ISFDB ID (6) and ISNI (19 - 16 plus three -)
---
 bookwyrm/activitypub/book.py                  |  1 +
 bookwyrm/forms/author.py                      |  2 ++
 .../migrations/0173_auto_20221228_1436.py     | 33 +++++++++++++++++++
 bookwyrm/models/author.py                     |  5 ++-
 bookwyrm/models/book.py                       |  2 +-
 bookwyrm/templates/author/author.html         | 10 +++++-
 bookwyrm/templates/author/edit_author.html    |  4 +++
 7 files changed, 54 insertions(+), 3 deletions(-)
 create mode 100644 bookwyrm/migrations/0173_auto_20221228_1436.py

diff --git a/bookwyrm/activitypub/book.py b/bookwyrm/activitypub/book.py
index 745aa3aab..d3aca4471 100644
--- a/bookwyrm/activitypub/book.py
+++ b/bookwyrm/activitypub/book.py
@@ -92,3 +92,4 @@ class Author(BookData):
     bio: str = ""
     wikipediaLink: str = ""
     type: str = "Author"
+    website: str = ""
diff --git a/bookwyrm/forms/author.py b/bookwyrm/forms/author.py
index a7811180f..37dba629f 100644
--- a/bookwyrm/forms/author.py
+++ b/bookwyrm/forms/author.py
@@ -15,6 +15,7 @@ class AuthorForm(CustomForm):
             "aliases",
             "bio",
             "wikipedia_link",
+            "website",
             "born",
             "died",
             "openlibrary_key",
@@ -31,6 +32,7 @@ class AuthorForm(CustomForm):
             "wikipedia_link": forms.TextInput(
                 attrs={"aria-describedby": "desc_wikipedia_link"}
             ),
+            "website": forms.TextInput(attrs={"aria-describedby": "desc_website"}),
             "born": forms.SelectDateWidget(attrs={"aria-describedby": "desc_born"}),
             "died": forms.SelectDateWidget(attrs={"aria-describedby": "desc_died"}),
             "oepnlibrary_key": forms.TextInput(
diff --git a/bookwyrm/migrations/0173_auto_20221228_1436.py b/bookwyrm/migrations/0173_auto_20221228_1436.py
new file mode 100644
index 000000000..1f6e1d87e
--- /dev/null
+++ b/bookwyrm/migrations/0173_auto_20221228_1436.py
@@ -0,0 +1,33 @@
+# Generated by Django 3.2.16 on 2022-12-28 14:36
+
+import bookwyrm.models.fields
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("bookwyrm", "0172_alter_user_preferred_language"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="author",
+            name="website",
+            field=bookwyrm.models.fields.CharField(
+                blank=True, max_length=255, null=True
+            ),
+        ),
+        migrations.AlterField(
+            model_name="author",
+            name="isfdb",
+            field=bookwyrm.models.fields.CharField(blank=True, max_length=6, null=True),
+        ),
+        migrations.AlterField(
+            model_name="author",
+            name="isni",
+            field=bookwyrm.models.fields.CharField(
+                blank=True, max_length=19, null=True
+            ),
+        ),
+    ]
diff --git a/bookwyrm/models/author.py b/bookwyrm/models/author.py
index b1d0510c9..78381a65e 100644
--- a/bookwyrm/models/author.py
+++ b/bookwyrm/models/author.py
@@ -17,12 +17,15 @@ class Author(BookDataModel):
         max_length=255, blank=True, null=True, deduplication_field=True
     )
     isni = fields.CharField(
-        max_length=255, blank=True, null=True, deduplication_field=True
+        max_length=19, blank=True, null=True, deduplication_field=True
     )
     gutenberg_id = fields.CharField(
         max_length=255, blank=True, null=True, deduplication_field=True
     )
     isfdb = fields.CharField(
+        max_length=6, blank=True, null=True, deduplication_field=True
+    )
+    website = fields.CharField(
         max_length=255, blank=True, null=True, deduplication_field=True
     )
     # idk probably other keys would be useful here?
diff --git a/bookwyrm/models/book.py b/bookwyrm/models/book.py
index a5be51a29..c44d47dd9 100644
--- a/bookwyrm/models/book.py
+++ b/bookwyrm/models/book.py
@@ -58,7 +58,7 @@ class BookDataModel(ObjectMixin, BookWyrmModel):
         max_length=255, blank=True, null=True, deduplication_field=True
     )
     isfdb = fields.CharField(
-        max_length=255, blank=True, null=True, deduplication_field=True
+        max_length=6, blank=True, null=True, deduplication_field=True
     )
     search_vector = SearchVectorField(null=True)
 
diff --git a/bookwyrm/templates/author/author.html b/bookwyrm/templates/author/author.html
index ade654568..62947eec0 100644
--- a/bookwyrm/templates/author/author.html
+++ b/bookwyrm/templates/author/author.html
@@ -28,7 +28,7 @@
     <meta itemprop="name" content="{{ author.name }}">
 
     {% firstof author.aliases author.born author.died as details %}
-    {% firstof author.wikipedia_link author.openlibrary_key author.inventaire_id author.isni author.isfdb as links %}
+    {% firstof author.wikipedia_link author.website author.openlibrary_key author.inventaire_id author.isni author.isfdb as links %}
     {% if details or links %}
     <div class="column is-3">
         {% if details %}
@@ -73,6 +73,14 @@
                 </div>
                 {% endif %}
 
+                {% if author.website %}
+                <div>
+                    <a itemprop="sameAs" href="{{ author.website }}" rel="nofollow noopener noreferrer" target="_blank">
+                        {% trans "Website" %}
+                    </a>
+                </div>
+                {% endif %}
+
                 {% if author.isni %}
                 <div class="mt-1">
                     <a itemprop="sameAs" href="{{ author.isni_link }}" rel="nofollow noopener noreferrer" target="_blank">
diff --git a/bookwyrm/templates/author/edit_author.html b/bookwyrm/templates/author/edit_author.html
index 1916df6be..9ea932bf6 100644
--- a/bookwyrm/templates/author/edit_author.html
+++ b/bookwyrm/templates/author/edit_author.html
@@ -57,6 +57,10 @@
 
             {% include 'snippets/form_errors.html' with errors_list=form.wikipedia_link.errors id="desc_wikipedia_link" %}
 
+            <p class="field"><label class="label" for="id_website">{% trans "Website:" %}</label> {{ form.website }}</p>
+
+            {% include 'snippets/form_errors.html' with errors_list=form.website.errors id="desc_website" %}
+
             <div class="field">
                 <label class="label" for="id_born">{% trans "Birth date:" %}</label>
                 <input type="date" name="born" value="{{ form.born.value|date:'Y-m-d' }}" class="input" id="id_born">

From 1e0cbe776c1b1b52dab379bc68a2c58f91d553ba Mon Sep 17 00:00:00 2001
From: Codimp <contact@lithio.fr>
Date: Tue, 15 Nov 2022 16:31:34 +0100
Subject: [PATCH 07/19] Add contrib directory with explanation

---
 contrib/README.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 contrib/README.md

diff --git a/contrib/README.md b/contrib/README.md
new file mode 100644
index 000000000..33b96832d
--- /dev/null
+++ b/contrib/README.md
@@ -0,0 +1,5 @@
+# Contrib
+
+This directory contain some scripts, configuration files and other useful tools around BookWyrm.
+
+These tools are not necessary for the proper functioning of BookWyrm but provide a helpful leg-up for integration with some third-party or to nicely fit BookWyrm into other environments.

From 358a0e60a93552594fddc0fbdbfa28a360d94ea1 Mon Sep 17 00:00:00 2001
From: Codimp <contact@lithio.fr>
Date: Tue, 15 Nov 2022 16:32:12 +0100
Subject: [PATCH 08/19] Add systemd service files for bookwyrm front, worker
 and scheduler

---
 contrib/systemd/bookwyrm-scheduler.service | 14 ++++++++++++++
 contrib/systemd/bookwyrm-worker.service    | 14 ++++++++++++++
 contrib/systemd/bookwyrm.service           | 14 ++++++++++++++
 3 files changed, 42 insertions(+)
 create mode 100644 contrib/systemd/bookwyrm-scheduler.service
 create mode 100644 contrib/systemd/bookwyrm-worker.service
 create mode 100644 contrib/systemd/bookwyrm.service

diff --git a/contrib/systemd/bookwyrm-scheduler.service b/contrib/systemd/bookwyrm-scheduler.service
new file mode 100644
index 000000000..601d8b73f
--- /dev/null
+++ b/contrib/systemd/bookwyrm-scheduler.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=BookWyrm scheduler
+After=network.target postgresql.service
+
+[Service]
+User=bookwyrm
+Group=bookwyrm
+WorkingDirectory=/opt/bookwyrm/
+ExecStart=/opt/bookwyrm/venv/bin/celery -A celerywyrm beat -l INFO --scheduler django_celery_beat.schedulers:DatabaseScheduler
+StandardOutput=journal
+StandardError=inherit
+
+[Install]
+WantedBy=multi-user.target
diff --git a/contrib/systemd/bookwyrm-worker.service b/contrib/systemd/bookwyrm-worker.service
new file mode 100644
index 000000000..7e25b0b17
--- /dev/null
+++ b/contrib/systemd/bookwyrm-worker.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=BookWyrm worker
+After=network.target postgresql.service redis.service
+
+[Service]
+User=bookwyrm
+Group=bookwyrm
+WorkingDirectory=/opt/bookwyrm/
+ExecStart=/opt/bookwyrm/venv/bin/celery -A celerywyrm worker -l info -Q high_priority,medium_priority,low_priority
+StandardOutput=journal
+StandardError=inherit
+
+[Install]
+WantedBy=multi-user.target
diff --git a/contrib/systemd/bookwyrm.service b/contrib/systemd/bookwyrm.service
new file mode 100644
index 000000000..a7e38746c
--- /dev/null
+++ b/contrib/systemd/bookwyrm.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=BookWyrm
+After=network.target postgresql.service
+
+[Service]
+User=bookwyrm
+Group=bookwyrm
+WorkingDirectory=/opt/bookwyrm/
+ExecStart=/opt/bookwyrm/venv/bin/gunicorn bookwyrm.wsgi:application --bind 0.0.0.0:8000
+StandardOutput=journal
+StandardError=inherit
+
+[Install]
+WantedBy=multi-user.target

From 45aa397863aafcd93be447f4b712a9c08330a5f1 Mon Sep 17 00:00:00 2001
From: Doctor <contact@lithio.fr>
Date: Fri, 30 Dec 2022 17:35:11 +0100
Subject: [PATCH 09/19] Add redis.service in After for bookwyrm and
 bookwyrm-scheduler services

---
 contrib/systemd/bookwyrm-scheduler.service | 2 +-
 contrib/systemd/bookwyrm.service           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/contrib/systemd/bookwyrm-scheduler.service b/contrib/systemd/bookwyrm-scheduler.service
index 601d8b73f..f3572f632 100644
--- a/contrib/systemd/bookwyrm-scheduler.service
+++ b/contrib/systemd/bookwyrm-scheduler.service
@@ -1,6 +1,6 @@
 [Unit]
 Description=BookWyrm scheduler
-After=network.target postgresql.service
+After=network.target postgresql.service redis.service
 
 [Service]
 User=bookwyrm
diff --git a/contrib/systemd/bookwyrm.service b/contrib/systemd/bookwyrm.service
index a7e38746c..c7ebe26ec 100644
--- a/contrib/systemd/bookwyrm.service
+++ b/contrib/systemd/bookwyrm.service
@@ -1,6 +1,6 @@
 [Unit]
 Description=BookWyrm
-After=network.target postgresql.service
+After=network.target postgresql.service redis.service
 
 [Service]
 User=bookwyrm

From bfe04feca9ea9e9b3a66a2861d2f37e1568c0896 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Fri, 30 Dec 2022 17:55:47 +0100
Subject: [PATCH 10/19] Add validation util + test

---
 bookwyrm/tests/test_utils.py | 18 ++++++++++++++++++
 bookwyrm/utils/validate.py   | 16 ++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 bookwyrm/utils/validate.py

diff --git a/bookwyrm/tests/test_utils.py b/bookwyrm/tests/test_utils.py
index 183548975..60f3185e6 100644
--- a/bookwyrm/tests/test_utils.py
+++ b/bookwyrm/tests/test_utils.py
@@ -3,6 +3,7 @@ import re
 from django.test import TestCase
 
 from bookwyrm.utils import regex
+from bookwyrm.utils.validate import validate_url_domain
 
 
 class TestUtils(TestCase):
@@ -11,3 +12,20 @@ class TestUtils(TestCase):
     def test_regex(self):
         """Regexes used throughout the app"""
         self.assertTrue(re.match(regex.DOMAIN, "xn--69aa8bzb.xn--y9a3aq"))
+
+    def test_valid_url_domain(self):
+        """Check with a valid URL"""
+        self.assertEqual(
+            validate_url_domain("https://your.domain.here/legit-book-url/"),
+            "https://your.domain.here/legit-book-url/",
+        )
+
+    def test_invalid_url_domain(self):
+        """Check with an invalid URL"""
+        self.assertEqual(
+            validate_url_domain("https://up-to-no-good.tld/bad-actor.exe"), "/"
+        )
+
+    def test_default_url_domain(self):
+        """Check with a default URL"""
+        self.assertEqual(validate_url_domain("/"), "/")
diff --git a/bookwyrm/utils/validate.py b/bookwyrm/utils/validate.py
new file mode 100644
index 000000000..0c0f01f06
--- /dev/null
+++ b/bookwyrm/utils/validate.py
@@ -0,0 +1,16 @@
+"""Validations"""
+from bookwyrm.settings import DOMAIN, USE_HTTPS
+
+
+def validate_url_domain(url, default="/"):
+    """Basic check that the URL starts with the instance domain name"""
+    if url in ("/", default):
+        return url
+
+    protocol = "https://" if USE_HTTPS else "http://"
+    origin = f"{protocol}{DOMAIN}"
+
+    if url.startswith(origin):
+        return url
+
+    return default

From 78c214a6d40c0dbd06c361c09df6efcd2798a644 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Fri, 30 Dec 2022 17:56:25 +0100
Subject: [PATCH 11/19] Add validation before using url

---
 bookwyrm/views/reading.py             | 2 ++
 bookwyrm/views/shelf/shelf_actions.py | 3 +++
 bookwyrm/views/status.py              | 3 +++
 3 files changed, 8 insertions(+)

diff --git a/bookwyrm/views/reading.py b/bookwyrm/views/reading.py
index d49ae30f7..5b7efc50a 100644
--- a/bookwyrm/views/reading.py
+++ b/bookwyrm/views/reading.py
@@ -12,6 +12,7 @@ from django.views.decorators.http import require_POST
 
 from bookwyrm import forms, models
 from bookwyrm.views.shelf.shelf_actions import unshelve
+from bookwyrm.utils.validate import validate_url_domain
 from .status import CreateStatus
 from .helpers import get_edition, handle_reading_status, is_api_request
 from .helpers import load_date_in_user_tz_as_utc
@@ -43,6 +44,7 @@ class ReadingStatus(View):
     def post(self, request, status, book_id):
         """Change the state of a book by shelving it and adding reading dates"""
         next_step = request.POST.get("next", "/")
+        next_step = validate_url_domain(next_step, "/")
         identifier = {
             "want": models.Shelf.TO_READ,
             "start": models.Shelf.READING,
diff --git a/bookwyrm/views/shelf/shelf_actions.py b/bookwyrm/views/shelf/shelf_actions.py
index 62bad3111..97fec52fb 100644
--- a/bookwyrm/views/shelf/shelf_actions.py
+++ b/bookwyrm/views/shelf/shelf_actions.py
@@ -3,6 +3,7 @@ from django.db import IntegrityError, transaction
 from django.contrib.auth.decorators import login_required
 from django.shortcuts import get_object_or_404, redirect
 from django.views.decorators.http import require_POST
+from bookwyrm.utils.validate import validate_url_domain
 
 from bookwyrm import forms, models
 
@@ -36,6 +37,7 @@ def delete_shelf(request, shelf_id):
 def shelve(request):
     """put a book on a user's shelf"""
     next_step = request.POST.get("next", "/")
+    next_step = validate_url_domain(next_step, "/")
     book = get_object_or_404(models.Edition, id=request.POST.get("book"))
     desired_shelf = get_object_or_404(
         request.user.shelf_set, identifier=request.POST.get("shelf")
@@ -97,6 +99,7 @@ def shelve(request):
 def unshelve(request, book_id=False):
     """remove a book from a user's shelf"""
     next_step = request.POST.get("next", "/")
+    next_step = validate_url_domain(next_step, "/")
     identity = book_id if book_id else request.POST.get("book")
     book = get_object_or_404(models.Edition, id=identity)
     shelf_book = get_object_or_404(
diff --git a/bookwyrm/views/status.py b/bookwyrm/views/status.py
index c29413816..a86f658bc 100644
--- a/bookwyrm/views/status.py
+++ b/bookwyrm/views/status.py
@@ -18,6 +18,7 @@ from django.views.decorators.http import require_POST
 from markdown import markdown
 from bookwyrm import forms, models
 from bookwyrm.utils import regex, sanitizer
+from bookwyrm.utils.validate import validate_url_domain
 from .helpers import handle_remote_webfinger, is_api_request
 from .helpers import load_date_in_user_tz_as_utc
 
@@ -59,6 +60,7 @@ class CreateStatus(View):
     def post(self, request, status_type, existing_status_id=None):
         """create status of whatever type"""
         next_step = request.POST.get("next", "/")
+        next_step = validate_url_domain(next_step, "/")
         created = not existing_status_id
         existing_status = None
         if existing_status_id:
@@ -169,6 +171,7 @@ def edit_readthrough(request):
     """can't use the form because the dates are too finnicky"""
     # TODO: remove this, it duplicates the code in the ReadThrough view
     next_step = request.POST.get("next", "/")
+    next_step = validate_url_domain(next_step, "/")
     readthrough = get_object_or_404(models.ReadThrough, id=request.POST.get("id"))
 
     readthrough.start_date = load_date_in_user_tz_as_utc(

From 2bf8cd88f17ff52f9ce8ffee5465c15955487f36 Mon Sep 17 00:00:00 2001
From: Arie van Deursen <arie.vandeursen@tudelft.nl>
Date: Fri, 30 Dec 2022 18:44:28 +0100
Subject: [PATCH 12/19] Fix @pytest.mark.skipif formatting

---
 bookwyrm/tests/models/test_book_model.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bookwyrm/tests/models/test_book_model.py b/bookwyrm/tests/models/test_book_model.py
index ea73ab442..33854b3d6 100644
--- a/bookwyrm/tests/models/test_book_model.py
+++ b/bookwyrm/tests/models/test_book_model.py
@@ -14,6 +14,7 @@ from bookwyrm import models, settings
 from bookwyrm.models.book import isbn_10_to_13, isbn_13_to_10
 from bookwyrm.settings import ENABLE_THUMBNAIL_GENERATION
 
+
 class Book(TestCase):
     """not too much going on in the books model but here we are"""
 
@@ -105,7 +106,7 @@ class Book(TestCase):
 
     @pytest.mark.skipif(
         not ENABLE_THUMBNAIL_GENERATION,
-        reason="Thumbnail generation disabled in settings"
+        reason="Thumbnail generation disabled in settings",
     )
     def test_thumbnail_fields(self):
         """Just hit them"""

From f266c71da92096921729697f6a218408f1c0f9df Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Sun, 1 Jan 2023 19:42:03 +0100
Subject: [PATCH 13/19] Replace hidden field with HTTP Referrer value

---
 .../snippets/reading_modals/finish_reading_modal.html         | 1 -
 .../snippets/reading_modals/progress_update_modal.html        | 1 -
 .../snippets/reading_modals/start_reading_modal.html          | 1 -
 .../templates/snippets/reading_modals/stop_reading_modal.html | 1 -
 .../templates/snippets/reading_modals/want_to_read_modal.html | 1 -
 bookwyrm/templates/snippets/shelf_selector.html               | 3 ---
 bookwyrm/templates/snippets/shelve_button/modal_button.html   | 1 -
 .../shelve_button/shelve_button_dropdown_options.html         | 2 --
 .../snippets/shelve_button/shelve_button_options.html         | 1 -
 bookwyrm/views/reading.py                                     | 2 +-
 bookwyrm/views/shelf/shelf_actions.py                         | 4 ++--
 bookwyrm/views/status.py                                      | 4 ++--
 12 files changed, 5 insertions(+), 17 deletions(-)

diff --git a/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html b/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html
index e79f0c5a3..ee720e448 100644
--- a/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/finish_reading_modal.html
@@ -14,7 +14,6 @@ Finish "<em>{{ book_title }}</em>"
 <input type="hidden" name="id" value="{{ readthrough.id }}">
 <input type="hidden" name="reading_status" value="read">
 <input type="hidden" name="shelf" value="{{ move_from }}">
-<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html b/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html
index 06dacda69..e0be1588d 100644
--- a/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/progress_update_modal.html
@@ -11,7 +11,6 @@
 {% csrf_token %}
 <input type="hidden" name="id" value="{{ readthrough.id }}">
 <input type="hidden" name="start_date" value="{{ readthrough.start_date|date:'Y-m-d' }}">
-<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html b/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html
index 00962d7f8..d8331a281 100644
--- a/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/start_reading_modal.html
@@ -13,7 +13,6 @@ Start "<em>{{ book_title }}</em>"
 {% csrf_token %}
 <input type="hidden" name="reading_status" value="reading">
 <input type="hidden" name="shelf" value="{{ move_from }}">
-<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html b/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html
index 37718134b..8e5ae7d65 100644
--- a/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/stop_reading_modal.html
@@ -14,7 +14,6 @@ Stop Reading "<em>{{ book_title }}</em>"
 <input type="hidden" name="id" value="{{ readthrough.id }}">
 <input type="hidden" name="reading_status" value="stopped-reading">
 <input type="hidden" name="shelf" value="{{ move_from }}">
-<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block reading-dates %}
diff --git a/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html b/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html
index f16c6d44a..80d67f79e 100644
--- a/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html
+++ b/bookwyrm/templates/snippets/reading_modals/want_to_read_modal.html
@@ -13,7 +13,6 @@ Want to Read "<em>{{ book_title }}</em>"
 {% csrf_token %}
 <input type="hidden" name="reading_status" value="to-read">
 <input type="hidden" name="shelf" value="{{ move_from }}"> 
-<input type="hidden" name="next" value="{{ request.path }}">
 {% endblock %}
 
 {% block form %}
diff --git a/bookwyrm/templates/snippets/shelf_selector.html b/bookwyrm/templates/snippets/shelf_selector.html
index c13c726e7..902a66196 100644
--- a/bookwyrm/templates/snippets/shelf_selector.html
+++ b/bookwyrm/templates/snippets/shelf_selector.html
@@ -22,7 +22,6 @@
         <input type="hidden" name="book" value="{{ book.id }}">
         <input type="hidden" name="change-shelf-from" value="{{ current.identifier }}">
         <input type="hidden" name="shelf" value="{{ shelf.identifier }}">
-        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small shelf-option is-radiusless has-background-body" type="submit" {% if shelf.identifier == current.identifier %}disabled{% endif %}>
             <span>
                 {% include "snippets/translated_shelf_name.html" with shelf=shelf %}
@@ -78,7 +77,6 @@
         {% csrf_token %}
         <input type="hidden" name="book" value="{{ book.id }}">
         <input type="hidden" name="shelf" value="{{ user_shelf.id }}">
-        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small is-radiusless is-danger is-light" type="submit">
             {% blocktrans with name=user_shelf|translate_shelf_name %}Remove from {{ name }}{% endblocktrans %}
         </button>
@@ -93,7 +91,6 @@
         {% csrf_token %}
         <input type="hidden" name="book" value="{{ book.id }}">
         <input type="hidden" name="shelf" value="{{ shelf.id }}">
-        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small is-radiusless is-danger is-light" type="submit">{% trans "Remove from" %} {{ shelf.name }}</button>
     </form>
 </li>
diff --git a/bookwyrm/templates/snippets/shelve_button/modal_button.html b/bookwyrm/templates/snippets/shelve_button/modal_button.html
index ef37f8872..a745b4fba 100644
--- a/bookwyrm/templates/snippets/shelve_button/modal_button.html
+++ b/bookwyrm/templates/snippets/shelve_button/modal_button.html
@@ -1,6 +1,5 @@
 {% load utilities %}
 <form name="fallback_form_{{ 0|uuid }}" method="GET" action="{{ fallback_url }}" autocomplete="off">
-    <input type="hidden" name="next" value="{{ request.path }}">
     <button
         type="submit"
         class="button {{ class }}"
diff --git a/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html b/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html
index c6a334180..73381558c 100644
--- a/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html
+++ b/bookwyrm/templates/snippets/shelve_button/shelve_button_dropdown_options.html
@@ -45,7 +45,6 @@
             <form name="shelve-{{ uuid }}-{{ shelf.identifier }}" action="/shelve/" method="post" autocomplete="off">
                 {% csrf_token %}
                 <input type="hidden" name="book" value="{{ active_shelf.book.id }}">
-                <input type="hidden" name="next" value="{{ request.path }}">
                 <button class="button {{ class }}" name="shelf" type="submit" value="{{ shelf.identifier }}" {% if book|is_book_on_shelf:shelf %} disabled {% endif %}>
                     <span>{{ shelf.name }}</span>
                 </button>
@@ -70,7 +69,6 @@
         {% csrf_token %}
         <input type="hidden" name="book" value="{{ active_shelf.book.id }}">
         <input type="hidden" name="shelf" value="{{ active_shelf.shelf.id }}">
-        <input type="hidden" name="next" value="{{ request.path }}">
         <button class="button is-fullwidth is-small{% if dropdown %} is-radiusless{% endif %} is-danger is-light" type="submit">
             {% blocktrans with name=active_shelf.shelf|translate_shelf_name %}Remove from {{ name }}{% endblocktrans %}
         </button>
diff --git a/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html b/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html
index e254d46c3..53ff80bf7 100644
--- a/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html
+++ b/bookwyrm/templates/snippets/shelve_button/shelve_button_options.html
@@ -62,7 +62,6 @@
         <form name="shelve-{{ uuid }}-{{ shelf.identifier }}" action="/shelve/" method="post">
             {% csrf_token %}
             <input type="hidden" name="book" value="{{ active_shelf.book.id }}">
-            <input type="hidden" name="next" value="{{ request.path }}">
             <button
                 class="button {{ class }}"
                 name="shelf"
diff --git a/bookwyrm/views/reading.py b/bookwyrm/views/reading.py
index 5b7efc50a..587c0d8d9 100644
--- a/bookwyrm/views/reading.py
+++ b/bookwyrm/views/reading.py
@@ -43,7 +43,7 @@ class ReadingStatus(View):
     @transaction.atomic
     def post(self, request, status, book_id):
         """Change the state of a book by shelving it and adding reading dates"""
-        next_step = request.POST.get("next", "/")
+        next_step = request.META.get('HTTP_REFERER')
         next_step = validate_url_domain(next_step, "/")
         identifier = {
             "want": models.Shelf.TO_READ,
diff --git a/bookwyrm/views/shelf/shelf_actions.py b/bookwyrm/views/shelf/shelf_actions.py
index 97fec52fb..da86cc853 100644
--- a/bookwyrm/views/shelf/shelf_actions.py
+++ b/bookwyrm/views/shelf/shelf_actions.py
@@ -36,7 +36,7 @@ def delete_shelf(request, shelf_id):
 @transaction.atomic
 def shelve(request):
     """put a book on a user's shelf"""
-    next_step = request.POST.get("next", "/")
+    next_step = request.META.get('HTTP_REFERER')
     next_step = validate_url_domain(next_step, "/")
     book = get_object_or_404(models.Edition, id=request.POST.get("book"))
     desired_shelf = get_object_or_404(
@@ -98,7 +98,7 @@ def shelve(request):
 @require_POST
 def unshelve(request, book_id=False):
     """remove a book from a user's shelf"""
-    next_step = request.POST.get("next", "/")
+    next_step = request.META.get('HTTP_REFERER')
     next_step = validate_url_domain(next_step, "/")
     identity = book_id if book_id else request.POST.get("book")
     book = get_object_or_404(models.Edition, id=identity)
diff --git a/bookwyrm/views/status.py b/bookwyrm/views/status.py
index a86f658bc..f703f8b77 100644
--- a/bookwyrm/views/status.py
+++ b/bookwyrm/views/status.py
@@ -59,7 +59,7 @@ class CreateStatus(View):
     # pylint: disable=too-many-branches
     def post(self, request, status_type, existing_status_id=None):
         """create status of whatever type"""
-        next_step = request.POST.get("next", "/")
+        next_step = request.META.get('HTTP_REFERER')
         next_step = validate_url_domain(next_step, "/")
         created = not existing_status_id
         existing_status = None
@@ -170,7 +170,7 @@ def update_progress(request, book_id):  # pylint: disable=unused-argument
 def edit_readthrough(request):
     """can't use the form because the dates are too finnicky"""
     # TODO: remove this, it duplicates the code in the ReadThrough view
-    next_step = request.POST.get("next", "/")
+    next_step = request.META.get('HTTP_REFERER')
     next_step = validate_url_domain(next_step, "/")
     readthrough = get_object_or_404(models.ReadThrough, id=request.POST.get("id"))
 

From bc19d7c658036de3ecd0df3d4388ff5b727d7ba0 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Sun, 1 Jan 2023 19:45:12 +0100
Subject: [PATCH 14/19] Black

---
 bookwyrm/views/reading.py             | 2 +-
 bookwyrm/views/shelf/shelf_actions.py | 4 ++--
 bookwyrm/views/status.py              | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/bookwyrm/views/reading.py b/bookwyrm/views/reading.py
index 587c0d8d9..42e8d560a 100644
--- a/bookwyrm/views/reading.py
+++ b/bookwyrm/views/reading.py
@@ -43,7 +43,7 @@ class ReadingStatus(View):
     @transaction.atomic
     def post(self, request, status, book_id):
         """Change the state of a book by shelving it and adding reading dates"""
-        next_step = request.META.get('HTTP_REFERER')
+        next_step = request.META.get("HTTP_REFERER")
         next_step = validate_url_domain(next_step, "/")
         identifier = {
             "want": models.Shelf.TO_READ,
diff --git a/bookwyrm/views/shelf/shelf_actions.py b/bookwyrm/views/shelf/shelf_actions.py
index da86cc853..b597bd35f 100644
--- a/bookwyrm/views/shelf/shelf_actions.py
+++ b/bookwyrm/views/shelf/shelf_actions.py
@@ -36,7 +36,7 @@ def delete_shelf(request, shelf_id):
 @transaction.atomic
 def shelve(request):
     """put a book on a user's shelf"""
-    next_step = request.META.get('HTTP_REFERER')
+    next_step = request.META.get("HTTP_REFERER")
     next_step = validate_url_domain(next_step, "/")
     book = get_object_or_404(models.Edition, id=request.POST.get("book"))
     desired_shelf = get_object_or_404(
@@ -98,7 +98,7 @@ def shelve(request):
 @require_POST
 def unshelve(request, book_id=False):
     """remove a book from a user's shelf"""
-    next_step = request.META.get('HTTP_REFERER')
+    next_step = request.META.get("HTTP_REFERER")
     next_step = validate_url_domain(next_step, "/")
     identity = book_id if book_id else request.POST.get("book")
     book = get_object_or_404(models.Edition, id=identity)
diff --git a/bookwyrm/views/status.py b/bookwyrm/views/status.py
index f703f8b77..52f547cdd 100644
--- a/bookwyrm/views/status.py
+++ b/bookwyrm/views/status.py
@@ -59,7 +59,7 @@ class CreateStatus(View):
     # pylint: disable=too-many-branches
     def post(self, request, status_type, existing_status_id=None):
         """create status of whatever type"""
-        next_step = request.META.get('HTTP_REFERER')
+        next_step = request.META.get("HTTP_REFERER")
         next_step = validate_url_domain(next_step, "/")
         created = not existing_status_id
         existing_status = None
@@ -170,7 +170,7 @@ def update_progress(request, book_id):  # pylint: disable=unused-argument
 def edit_readthrough(request):
     """can't use the form because the dates are too finnicky"""
     # TODO: remove this, it duplicates the code in the ReadThrough view
-    next_step = request.META.get('HTTP_REFERER')
+    next_step = request.META.get("HTTP_REFERER")
     next_step = validate_url_domain(next_step, "/")
     readthrough = get_object_or_404(models.ReadThrough, id=request.POST.get("id"))
 

From ac2ef667aff282e8273c92ec339a011d41c51aa2 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Sun, 1 Jan 2023 19:57:10 +0100
Subject: [PATCH 15/19] Fix error when no referer

---
 bookwyrm/utils/validate.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bookwyrm/utils/validate.py b/bookwyrm/utils/validate.py
index 0c0f01f06..a6272319b 100644
--- a/bookwyrm/utils/validate.py
+++ b/bookwyrm/utils/validate.py
@@ -4,7 +4,7 @@ from bookwyrm.settings import DOMAIN, USE_HTTPS
 
 def validate_url_domain(url, default="/"):
     """Basic check that the URL starts with the instance domain name"""
-    if url in ("/", default):
+    if url in ("/", default, None):
         return url
 
     protocol = "https://" if USE_HTTPS else "http://"

From fa3edea87b9dc23ae6c714aa3f42cb26b6023d8d Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Sun, 1 Jan 2023 20:51:23 +0100
Subject: [PATCH 16/19] Update validate.py

---
 bookwyrm/utils/validate.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bookwyrm/utils/validate.py b/bookwyrm/utils/validate.py
index a6272319b..89aee4782 100644
--- a/bookwyrm/utils/validate.py
+++ b/bookwyrm/utils/validate.py
@@ -4,7 +4,10 @@ from bookwyrm.settings import DOMAIN, USE_HTTPS
 
 def validate_url_domain(url, default="/"):
     """Basic check that the URL starts with the instance domain name"""
-    if url in ("/", default, None):
+    if not url:
+        return default
+
+    if url in ("/", default):
         return url
 
     protocol = "https://" if USE_HTTPS else "http://"

From 3f6cdff3635c26bef829ac3c6f3573995f3a17a7 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Sun, 1 Jan 2023 21:06:35 +0100
Subject: [PATCH 17/19] Update github actions versions

---
 .github/workflows/black.yml           | 6 +++---
 .github/workflows/codeql-analysis.yml | 8 ++++----
 .github/workflows/curlylint.yaml      | 2 +-
 .github/workflows/django-tests.yml    | 4 ++--
 .github/workflows/lint-frontend.yaml  | 2 +-
 .github/workflows/prettier.yaml       | 2 +-
 .github/workflows/pylint.yml          | 4 ++--
 7 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/black.yml b/.github/workflows/black.yml
index 7258b6087..2e4ffa2cc 100644
--- a/.github/workflows/black.yml
+++ b/.github/workflows/black.yml
@@ -10,6 +10,6 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v2
-      - uses: psf/black@21.4b2
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+      - uses: psf/black@22.12
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index d35f90eb5..68bb05d7e 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -36,11 +36,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -51,7 +51,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@v2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -65,4 +65,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v2
diff --git a/.github/workflows/curlylint.yaml b/.github/workflows/curlylint.yaml
index 593a42837..8d5c6b4f7 100644
--- a/.github/workflows/curlylint.yaml
+++ b/.github/workflows/curlylint.yaml
@@ -10,7 +10,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Install curlylint
         run: pip install curlylint
diff --git a/.github/workflows/django-tests.yml b/.github/workflows/django-tests.yml
index 4335a4605..da11fe09e 100644
--- a/.github/workflows/django-tests.yml
+++ b/.github/workflows/django-tests.yml
@@ -23,9 +23,9 @@ jobs:
         ports:
           - 5432:5432
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Set up Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v4
       with:
         python-version: 3.9
     - name: Install Dependencies
diff --git a/.github/workflows/lint-frontend.yaml b/.github/workflows/lint-frontend.yaml
index c97ee02ad..0d0559e40 100644
--- a/.github/workflows/lint-frontend.yaml
+++ b/.github/workflows/lint-frontend.yaml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Install modules
         run: npm install stylelint stylelint-config-recommended stylelint-config-standard stylelint-order eslint
diff --git a/.github/workflows/prettier.yaml b/.github/workflows/prettier.yaml
index c4a031dba..a081e1a7a 100644
--- a/.github/workflows/prettier.yaml
+++ b/.github/workflows/prettier.yaml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Install modules
         run: npm install prettier
diff --git a/.github/workflows/pylint.yml b/.github/workflows/pylint.yml
index a3117f7cb..3811c97d3 100644
--- a/.github/workflows/pylint.yml
+++ b/.github/workflows/pylint.yml
@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Set up Python 3.9
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v4
       with:
         python-version: 3.9
     - name: Install Dependencies

From 4b55b4c0262acc2b7308f57d7b76638b57d8f645 Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Sun, 1 Jan 2023 21:09:25 +0100
Subject: [PATCH 18/19] Update black

---
 .github/workflows/black.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/black.yml b/.github/workflows/black.yml
index 2e4ffa2cc..95a0ebfb0 100644
--- a/.github/workflows/black.yml
+++ b/.github/workflows/black.yml
@@ -12,4 +12,4 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-python@v4
-      - uses: psf/black@22.12
+      - uses: psf/black@22.12.0

From 892ba563a4b72a1409628d27727e360ec96efa5b Mon Sep 17 00:00:00 2001
From: Giebisch <rafael@giebisch-mail.de>
Date: Sat, 7 Jan 2023 20:59:32 +0100
Subject: [PATCH 19/19] Fix Half Stars for Rating books

---
 bookwyrm/templates/snippets/form_rate_stars.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bookwyrm/templates/snippets/form_rate_stars.html b/bookwyrm/templates/snippets/form_rate_stars.html
index 71499b700..8cc405abb 100644
--- a/bookwyrm/templates/snippets/form_rate_stars.html
+++ b/bookwyrm/templates/snippets/form_rate_stars.html
@@ -37,7 +37,7 @@
             type="radio"
             name="rating"
             value="{{ forloop.counter0 }}.5"
-            {% if default_rating > 0 and default_rating >= forloop.counter0 %}checked{% endif %}
+            {% if default_rating > 0 and default_rating > forloop.counter0 %}checked{% endif %}
         />
         <input
             id="{{ type|slugify }}_book{{ book.id }}_star_{{ forloop.counter }}"