Fix safe_return_to being uncallable from controllers

Defined only in ApplicationHelper, which Rails auto-mixes into views
but not controllers - so events#create and events#update, which call
it directly, have been broken since introduction. Likely unexercised
until now because every existing event was created via
node.events.create! in the seed script, never through a real POST.

Moved to ApplicationController as a protected method + helper_method
declaration, so both controllers and views can call it (form_error_
messages stays in ApplicationHelper - it's genuinely view-only,
content_tag isn't available in a controller either). Logic unchanged,
caught by the new EventsController tests in the previous commit.

1 files changed, 12 insertions, 0 deletions

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 75f92c3..cbeb40d 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -5,6 +5,8 @@ class ApplicationController < ActionController::Base
 
   before_action :set_locale
 
+  helper_method :safe_return_to
+
   protected
 
   def set_locale
@@ -18,4 +20,14 @@ class ApplicationController < ActionController::Base
   def default_url_options
     { locale: I18n.locale == I18n.default_locale ? nil : I18n.locale }
   end
+
+  def safe_return_to(url)
+    return events_path if url.blank?
+    uri = URI.parse(url)
+    return events_path if uri.host.present?
+    return events_path unless url.start_with?('/')
+    url
+  rescue URI::InvalidURIError
+    events_path
+  end
 end