Update cms/server/contest/handlers/main.py

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: pxsit

cms/server/contest/handlers/main.py

@@ -222,9 +222,13 @@ def post(self):
             if split.scheme or split.netloc or not split.path.startswith("/"):
                 next_page = self.contest_url()
             elif split.path != "/":
-                next_page = self.url(*split.path.strip("/").split("/"))
-                if split.query:
-                    next_page += "?" + split.query
+                path_segments = split.path.strip("/").split("/")
+                if any(segment in ("", ".", "..") for segment in path_segments):
+                    next_page = self.contest_url()
+                else:
+                    next_page = self.url(*path_segments)
+                    if split.query:
+                        next_page += "?" + split.query
             else:
                 next_page = self.url()
         else: