Preserve navigation context when opening cards from filtered views by Sanyamjin · Pull Request #2565 · basecamp/fizzy

Sanyamjin · 2026-02-18T06:45:53Z

Currently, when opening a card from filtered views such as “Assigned to Me”, the back link always returns to the card’s board.

This change introduces support for 'return_to' and 'return_label'
so that the back link preserves navigation context.

Adds 'return_to' and 'return_label' parameters to card links
Updates 'link_back_to_board' helper to respect them
Falls back to board name and path when not provided
Prevents open redirects

This keeps navigation stateless and improves UX consistency.

Sanyamjin · 2026-02-19T11:06:31Z

@jeremy Could you please review this PR when you have a moment? Thanks!

Copilot

Pull request overview

Adds stateless “return to where I came from” navigation when opening a card from filtered/alternate views, so the back link can return to the originating list instead of always returning to the board.

Changes:

Appends return_to and return_label query params to card links from card preview tiles.
Updates link_back_to_board to prefer a validated return_to + return_label, falling back to the board path/name.
Introduces page_title_for_return to supply a label for the return context.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
app/views/cards/display/_preview.html.erb	Adds `return_to`/`return_label` to card links from preview tiles.
app/helpers/boards_helper.rb	Updates back-link helper to use validated return params (open-redirect mitigation).
app/helpers/application_helper.rb	Adds helper to provide a label for “return” navigation context.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

app/helpers/application_helper.rb

Copilot · 2026-02-20T01:24:00Z

app/views/cards/display/_preview.html.erb

 <%= card_article_tag card, class: "card", draggable: draggable, data: card_data, tabindex: 0 do %>
  <div class="flex flex-column flex-item-grow max-inline-size">
-    <%= link_to card_path(card), draggable: false, class: "card__link", title: card_title_tag(card), data: { action: "dialog#close", turbo_frame: "_top" } do %>
+    <%= link_to card_path(card, return_to: request.fullpath, return_label: page_title_for_return), draggable: false, class: "card__link", title: card_title_tag(card), data: { action: "dialog#close", turbo_frame: "_top" } do %>


card_path(... return_to: request.fullpath ...) is rendered inside a collection-cached partial (see cards/display/_previews.html.erb uses cached: true) and is also rendered from Turbo Stream pagination (cards/previews#index). This will (1) cache and reuse a return_to from the first render across other pages/filters/users, and (2) set return_to to the pagination endpoint (e.g. /cards/previews?...) when cards are appended via Turbo Streams, breaking the back link (HTML navigation to that endpoint may even lack an HTML template). Consider passing return_to/return_label in as locals from the host page and either excluding the link from the cached fragment or keying the cache on those locals (or disabling caching for this partial).

okay i have noted this suggestion and added
<%= render "cards/display/previews",
cards: @page.records,
draggable: true,
return_to: request.fullpath,
return_label: @board.name %>

to all the pages rendering this.
i changed _preview.html.erb back and added return_to and return_label as locals in _previews

Copilot · 2026-02-20T01:24:00Z

app/helpers/boards_helper.rb

+    uri = URI.parse(params[:return_to])
+    return unless uri.host.nil? # prevents open redirect
+
+    params[:return_to]


safe_return_to only checks uri.host.nil?. This still allows dangerous/incorrect values like protocol-relative URLs (//evil.com/path) and non-HTTP schemes (javascript:...), both of which can produce external navigation or script execution when used as an href. Tighten validation to allow only same-origin relative paths (e.g., require uri.scheme.nil? && uri.host.nil?, and that the raw value starts with a single / but not //; optionally normalize to uri.request_uri).

Suggested change

uri = URI.parse(params[:return_to])

return unless uri.host.nil? # prevents open redirect

params[:return_to]

raw = params[:return_to].to_s

# Only allow same-origin relative paths starting with a single "/"

return unless raw.start_with?("/") && !raw.start_with?("//")

uri = URI.parse(raw)

return unless uri.scheme.nil? && uri.host.nil? # prevents open redirect and non-HTTP schemes

uri.request_uri

reviewed the suggestion and added conditions for safe redirects and avoiding non-http schemes

Copilot · 2026-02-20T01:24:00Z

app/helpers/boards_helper.rb

  def link_back_to_board(board)
-    back_link_to board.name, board, "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click click->turbo-navigation#backIfSamePath"
+    path = safe_return_to || board
+    label = params[:return_label].presence || board.name
+    back_link_to(
+      label,
+      path,
+      "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click click->turbo-navigation#backIfSamePath"
+    )


link_back_to_board now changes behavior based on user-controlled query params (return_to / return_label). Given the security-sensitive nature (open redirect prevention) and the multiple edge cases (invalid URI, protocol-relative URLs, missing/blank label), it would be good to add a helper test file (e.g., test/helpers/boards_helper_test.rb) covering accepted relative paths and rejected external/scheme/protocol-relative values, and asserting fallback to board/board.name when params are missing/invalid.

added a safe_path to avoid any open redirect risks.

also added a boards_helper_test file covering all accepted relative paths and rejecting external values.

Sanyamjin · 2026-02-21T05:09:22Z

@jeremy can you please review the changes . thank you

jeremy

Take a look at FilterScoped. Rather than doing a generic return_to/return_label, what we need here is to preserve user filtering params.

jeremy · 2026-02-21T19:27:30Z

app/helpers/application_helper.rb

+  def page_title_for_return
+    @page_title.presence
+  end


Suggested change

def page_title_for_return

@page_title.presence

end

This is now unused huh?

yes this is unused now.

jeremy · 2026-02-21T19:28:19Z

app/helpers/boards_helper.rb

+
+    raw
+  rescue URI::InvalidURIError
+    nil


Match the repo's code style, please. See STYLE.md: indent under method visibility, avoid early-return exits in favor of conditional expressions.

thanks for the suggestion jeremy. i will match the repo's code style moving forward.

jeremy · 2026-02-21T19:31:22Z

test/helpers/boards_helper_test.rb

+    @board = Board.find(
+    ActiveRecord::FixtureSet.identify("writebook", :uuid)
+    )


Suggested change

@board = Board.find(

ActiveRecord::FixtureSet.identify("writebook", :uuid)

)

@board = Board.find(ActiveRecord::FixtureSet.identify("writebook", :uuid))

corrected the code style.

jeremy · 2026-02-21T19:35:32Z

app/views/boards/columns/closeds/show.html.erb

+                cards: @page.records,
+                draggable: true,
+                return_to: request.fullpath,
+                return_label: @board.name %>


Let's omit the defaults from all these partial renders. Should only need to pass when they differ.

okay jeremy i have omitted the defaults from all these partial renders except index.html.erb as default differs here.

jeremy · 2026-02-21T19:36:01Z

app/views/cards/display/_preview.html.erb

@@ -1,3 +1,4 @@
+<%# expects: card:, return_to:, return_label: %>


Should be optional, defaulting to the board.

okay i have added an optional condition here

…renders

Sanyamjin · 2026-02-23T07:44:23Z

@jeremy i’ve addressed the issues and made the requested changes. Could you please review them when you have a moment? Thank you.

Sanyamjin · 2026-02-27T07:18:40Z

@jayohms Could you please review the pr and changes addresses in it when you have a moment? Thank you.

Preserve navigation context when opening cards from filtered views

f7df6c3

jeremy requested a review from Copilot February 20, 2026 01:18

Copilot started reviewing on behalf of jeremy February 20, 2026 01:19 View session

Copilot AI reviewed Feb 20, 2026

View reviewed changes

Address PR review: fix cache key and return_to propagation

bcf1c96

jeremy requested changes Feb 21, 2026

View reviewed changes

Fixed the changes in codestyle and omitted the defaults from partial …

5f45d52

…renders

-    uri = URI.parse(params[:return_to])
-    return unless uri.host.nil? # prevents open redirect
-    params[:return_to]
+    raw = params[:return_to].to_s
+    # Only allow same-origin relative paths starting with a single "/"
+    return unless raw.start_with?("/") && !raw.start_with?("//")
+    uri = URI.parse(raw)
+    return unless uri.scheme.nil? && uri.host.nil? # prevents open redirect and non-HTTP schemes
+    uri.request_uri

		@@ -1,3 +1,4 @@
		<%# expects: card:, return_to:, return_label: %>

Conversation

Sanyamjin commented Feb 18, 2026

Uh oh!

Sanyamjin commented Feb 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Sanyamjin Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Sanyamjin commented Feb 21, 2026

Uh oh!

jeremy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Sanyamjin commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Sanyamjin commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Sanyamjin Feb 20, 2026 •

edited

Loading

Sanyamjin commented Feb 23, 2026 •

edited

Loading