next spam.

modified:   make_post_sell/request_methods.py

make_post_sell/request_methods.py

@@ -109,14 +109,19 @@ def includeme(config):
         import re
         from pyramid.httpexceptions import HTTPUnauthorized
 
-        # Regex to detect nested encoded 'next=' patterns
-        next_pattern = re.compile(r"(next(?:%25|%3D))+", re.IGNORECASE)
-        matches = next_pattern.findall(request.query_string)
+        # Allow one unescaped "next=" but block multiple or any escaped forms
+        query_string = request.query_string
 
-        if len(matches) > 1:
+        # Check for exact "next=" (case insensitive)
+        unescaped_next_count = len(re.findall(r"(?i)\bnext=", query_string))
+
+        # Check for escaped versions (case insensitive)
+        escaped_next_match = re.search(r"(?i)next%25|next%3D", query_string)
+
+        if unescaped_next_count > 1 or escaped_next_match:
             print(
                 f"Blocked spam request from {request.remote_addr}: "
-                f"Multiple encoded 'next=' patterns detected."
+                f"Multiple or escaped 'next=' patterns detected."
             )
             return HTTPUnauthorized("Request appears malformed or spammy.")