Fix redirect after firm task sync

app/modules/services/ui.py

@@ -2557,17 +2557,43 @@ def sync_system_default_tasks_for_firm(request: Request, catalogue_id: int):
         )
         db.commit()
 
-        return RedirectResponse(
+        # Return to the actual page that submitted the sync action instead of
-            url=(
+        # assuming a hard-coded firm-task-list URL. This preserves the current
-                f"/services/catalogue/{catalogue_id}/firm-tasks"
+        # production routing structure.
-                f"?sync_success=1"
+        from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
-                f"&created={result.created}"
+
-                f"&updated={result.updated}"
+        referer = request.headers.get("referer") or f"/services/catalogue/{catalogue_id}"
-                f"&unchanged={result.unchanged}"
+        parsed = urlsplit(referer)
-                f"&duplicates_disabled={result.duplicates_disabled}"
+
-            ),
+        # Prevent an external/open redirect. For a normal browser form POST the
-            status_code=303,
+        # Referer is same-origin; if it is not, fall back to the Services page.
+        request_host = request.headers.get("host", "")
+        if parsed.netloc and parsed.netloc != request_host:
+            referer = f"/services/catalogue/{catalogue_id}"
+            parsed = urlsplit(referer)
+
+        query = dict(parse_qsl(parsed.query, keep_blank_values=True))
+        query.update(
+            {
+                "sync_success": "1",
+                "created": str(result.created),
+                "updated": str(result.updated),
+                "unchanged": str(result.unchanged),
+                "duplicates_disabled": str(result.duplicates_disabled),
+            }
         )
+
+        redirect_url = urlunsplit(
+            (
+                parsed.scheme,
+                parsed.netloc,
+                parsed.path,
+                urlencode(query),
+                parsed.fragment,
+            )
+        )
+
+        return RedirectResponse(url=redirect_url, status_code=303)
     except Exception:
         db.rollback()
         raise