Api v2 get note #720
Api v2 get note #720
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -113,4 +101,4 @@ | |||
| if not next_url or urlsplit(next_url).netloc != '': | |||
| next_url = url_for('index.index', cid=user.ctx_case) | |||
|
|
|||
| return redirect(next_url) | |||
| return redirect(next_url) | |||
Check warning
Code scanning / CodeQL
URL redirection from remote source Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 1 day ago
To fix the problem, we need to enhance the validation of the next_url parameter to ensure it is safe for redirection. We can use the url_has_allowed_host_and_scheme function from Django, which is specifically designed to check if a URL is safe for redirection. This function handles backslashes correctly and ensures that the URL is either relative or has an allowed host and scheme.
We will modify the _is_safe_url function to use url_has_allowed_host_and_scheme for validation. Additionally, we will ensure that the next_url parameter is properly sanitized before being used in the redirect.
| @@ -1,2 +1,3 @@ | ||
| from urllib.parse import urlparse, urljoin | ||
| from django.utils.http import url_has_allowed_host_and_scheme | ||
|
|
||
| @@ -68,8 +69,6 @@ | ||
| """ | ||
| Check whether the target URL is safe for redirection by ensuring that it is either a relative URL or | ||
| has the same host as the current request. | ||
| Check whether the target URL is safe for redirection by using the url_has_allowed_host_and_scheme function. | ||
| """ | ||
| ref_url = urlparse(request.host_url) | ||
| test_url = urlparse(urljoin(request.host_url, target)) | ||
| return test_url.scheme in ('http', 'https') and ref_url.netloc == test_url.netloc | ||
| from django.utils.http import url_has_allowed_host_and_scheme | ||
| return url_has_allowed_host_and_scheme(target, allowed_hosts={request.host}) | ||
|
|
||
| @@ -83,3 +82,3 @@ | ||
| # Remove backslashes to mitigate obfuscation | ||
| next_url = next_url.replace('\\', '') | ||
| next_url = next_url.replace('\\', '/') | ||
| if _is_safe_url(next_url): |
| @@ -52,2 +52,3 @@ | ||
| dependencies/iris_intelowl_module-0.1.0-py3-none-any.whl | ||
| dependencies/iris_seika_module-1.0.0-py3-none-any.whl | ||
| dependencies/iris_seika_module-1.0.0-py3-none-any.whl | ||
| django==5.1.6 |
| Package | Version | Security advisories |
| django (pypi) | 5.1.6 | None |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
c8y3
force-pushed
the
api_v2_get_note
branch
from
ce032fe to
a656648
Compare
…r}/notes, to create a note
… case_identifier does not exist
… with directory_id does not exist
… with directory_id is in another case
…identifier}/notes
…/{case_identifier}/notes/{identifier}
…he app, instead of importing the app
c8y3
force-pushed
the
api_v2_get_note
branch
from
a656648 to
f01f9be
Compare
Implementation of endpoint
GET /api/v2/cases/{case_identifier}/notes/{identifier}to get a note.Tasks performed:
GET /case/notes/{note_id}from app.post_init import run_post_initat the top of the fileapp.config['timezone'] = 'Europe/Paris') directly in the__init__.py(because otherwise, the moment this configuration is set in the configuration depends on the order of imports)This PR goes with the accompanying documentation iris-doc-src PR#42