Use htmx for old table batch actions #4210
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| form = self.form_class(self.request.POST) | ||
| if form.is_valid(): | ||
| # If a user without archive edit access is somehow able to access batch archive submissions | ||
| # (ie. they were looking at the submission list when permissions changed) "refresh" the page |
Check warning
Code scanning / CodeQL
URL redirection from remote source Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 4 months ago
To fix the problem, we need to ensure that the URL used in the redirection is validated to prevent open redirect vulnerabilities. We can use Django's url_has_allowed_host_and_scheme function to check that the URL is safe to redirect to. This function ensures that the URL is either relative or belongs to an allowed host.
We will modify the code to validate self.request.path before using it in the redirection. If the URL is not valid, we will redirect to a safe default URL, such as the home page.
| @@ -25,2 +25,3 @@ | ||
| from django.shortcuts import get_object_or_404, redirect, render | ||
| from django.utils.http import url_has_allowed_host_and_scheme | ||
| from django.urls import reverse_lazy | ||
| @@ -380,3 +381,6 @@ | ||
| if not can_alter_archived_submissions(self.request.user): | ||
| return HttpResponseRedirect(self.request.path) | ||
| if url_has_allowed_host_and_scheme(self.request.path, allowed_hosts=None): | ||
| return HttpResponseRedirect(self.request.path) | ||
| else: | ||
| return redirect('/') | ||
| submissions = form.cleaned_data["submissions"] |
sandeepsajan0
requested review from
frjo and
theskumar
and removed request for
frjo
|
Closing this in favor of #4226 |
Fixes #ISSUEID
Test Steps