grrrrrr request next spammer

make_post_sell/request_methods.py

@@ -109,19 +109,18 @@ def includeme(config):
         import re
         from pyramid.httpexceptions import HTTPUnauthorized
 
-        # Allow one unescaped "next=" but block multiple or any escaped forms
         query_string = request.query_string
 
-        # Check for exact "next=" (case insensitive)
+        # Check for double or nested "next=" patterns
         unescaped_next_count = len(re.findall(r"(?i)\bnext=", query_string))
+        escaped_next_count = len(
+            re.findall(r"(?i)\bnext%25|next%3D|next%253D|next%2525", query_string)
+        )
 
-        # Check for escaped versions (case insensitive)
-        escaped_next_match = re.search(r"(?i)next%25|next%3D", query_string)
-
-        if unescaped_next_count > 1 or escaped_next_match:
+        if unescaped_next_count + escaped_next_count > 1:
             print(
                 f"Blocked spam request from {request.remote_addr}: "
-                f"Multiple or escaped 'next=' patterns detected."
+                f"Multiple or nested 'next=' patterns detected."
             )
             return HTTPUnauthorized("Request appears malformed or spammy.")