Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Return a refused 'Manage plan' click to the page it came from

Open
  • Is something wrong?
#381 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
62/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
full-stack

Research direction

Start in the plan handoff route and its error redirect to /w/<slug>/settings?plan_error=, then the two places that render the Manage plan card (General settings and the plan page) and the page that reads plan_error. Pass the origin page as a fixed value from a closed list of the two pages, falling back to General. Read src/plan-handoff/README.md too. Done when tests T01 to T06 in the issue pass, including the Location check for 303 responses.

Written by the indexing model from the issue text.

Description

area: app type: feature

Follow-up of #284 (plan hand-over) and #282 (plan and usage page). Part of #268.

Problem

"Manage plan" is on the General settings page and on the plan page. A click that the route refuses (cross_site_request, rate_limited) always answers 303 back to /w/<slug>/settings?plan_error=<code>. A person who clicked on the plan page therefore ends on General, with the message next to the card there. The route never reads the body or the query of the request (no open redirect, by design in #284), so it cannot know where the click came from.

Behavior

  • A refused click returns the person to the page they clicked on, with the same message next to the card.
  • The route still never reads anything from the request that chooses a target. The place the click came from is decided only from a closed list of the two pages (for example one fixed form action path per page, or a fixed value from a closed set), never from a free address, so there is still no open redirect.
  • An unknown or missing origin falls back to General settings, as today.
  • No change for a successful click (still 303 to the configured page with the token).

Scope

The handoff route and its error redirect, the two places that render the card, the page that reads plan_error, src/plan-handoff/README.md.

Out of scope

Anything about the hand-over target or token (#284), the plan page content (#282).

Test cases

ID kind level case expected
T01 regression integration refused click from General (cross-site, rate limit) 303 to General with plan_error as today
T02 behavior integration refused click from the plan page 303 to the plan page with plan_error
T03 security integration an origin signal that is another address, an absolute URL, a path outside the two pages or an unknown value falls back to General; the Location is always a path of this app from the closed list
T04 regression integration successful click from either page 303 to the configured page with the token, as today
T05 behavior unit the plan page and General read plan_error the message shows next to the card on the page that was clicked, and nothing for any other value
T06 security integration free-form data in the body or an address in the request never chooses the target; only the closed list of the two pages does
Dominant language
TypeScript
Stars
0
Forks
1
Avg merge
1h 15m
Merged PRs (30d)
217

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ExpidetGames/code-reviewer

All issues in ExpidetGames/code-reviewer

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.