MSOP-1: restore auth on /v4/radar; keep post-login redirect on current host.

Co-authored-by: Cursor <cursoragent@cursor.com>

application/controllers/Login.php

@@ -90,10 +90,19 @@ class Login extends CI_Controller {
 
                 if ($page) {
                     setcookie('derniere_page','',time()-3600,'/');
-                    header("Location: ".$page);
+                    // Path only — rester sur le host où on s’est logué (pas prod via URL absolue).
+                    if (preg_match('#^https?://#i', $page)) {
+                        $parts = parse_url($page);
+                        $page = ($parts['path'] ?? '/')
+                            . (isset($parts['query']) ? '?'.$parts['query'] : '');
+                    }
+                    if ($page === '' || $page[0] !== '/') {
+                        $page = '/';
+                    }
+                    header('Location: '.$page);
                     exit;
                 }
-                    redirect('/');
+                redirect('/');
 
             }
 

v4_ci4/app/Config/Filters.php

@@ -73,8 +73,7 @@ class Filters extends BaseFilters
      */
     public array $globals = [
         'before' => [
-            // TEMP DEV (soirée test) — Radar sans auth. Remettre auth strict après.
-            'auth' => ['except' => ['radar', 'radar/*']],
+            'auth',
             // 'honeypot',
             // 'csrf',
             // 'invalidchars',