gtfo next redirect spammers

this prevents a denial of service, otherwise uwsgi is oom'd by linux.

	modified:   make_post_sell/request_methods.py

make_post_sell/request_methods.py

@@ -105,12 +105,30 @@ def includeme(config):
         return None
 
     def add_spam(request):
-        """Test if request looks spammy HTTP Error or False."""
-        if request.params.get("email2", "") != "":
-            # spam filter, hidden email2 field tricks bots.
-            from pyramid.httpexceptions import HTTPUnauthorized
+        """Test if request looks spammy. Returns HTTP Error or False."""
+        import re
+        from pyramid.httpexceptions import HTTPUnauthorized
 
-            return HTTPUnauthorized("you smell like a spammer")
+        # Regex to detect nested encoded 'next=' patterns
+        next_pattern = re.compile(r"(next%25)+", re.IGNORECASE)
+        matches = next_pattern.findall(request.query_string)
+
+        if len(matches) > 1:
+            print(
+                f"Blocked spam request from {request.remote_addr}: "
+                f"Multiple encoded 'next=' patterns detected."
+            )
+            return HTTPUnauthorized("Request appears malformed or spammy.")
+
+        # Existing hidden spam field detection
+        if request.params.get("email2", "") != "":
+            print(
+                f"Blocked spam request from {request.remote_addr}: Hidden field populated."
+            )
+            return HTTPUnauthorized("You smell like a spammer.")
+
+        # If no spam detected, return False
+        return False
 
     def add_app(request):
         """Attach app settings dictionary."""