Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Candidature: traitement par lot [GEN-1949] #5242

Draft
wants to merge 43 commits into
base: master
Choose a base branch
from
Draft

Candidature: traitement par lot [GEN-1949] #5242

wants to merge 43 commits into from

Conversation

xavfernandez
Copy link
Contributor

🤔 Pourquoi ?

Indiquez le problème que nous sommes en train de résoudre et les objectifs métiers ou techniques qui sont visés par ces changements.

🍰 Comment ?

Décrivez en quelques mots la solution retenue et mise en oeuvre, les difficultés ou problèmes rencontrés. Attirez l'attention sur les décisions d'architecture ou de conception importantes.

🚨 À vérifier

  • Mettre à jour le CHANGELOG_breaking_changes.md ?

🏝️ Comment tester

Les instructions pour reproduire le problème, les profils de test, le parcours spécifique à utiliser, etc. Si vous disposez d'une recette jetable, mettre l'URL pour tester dans cette partie.

💻 Captures d'écran

@xavfernandez xavfernandez added the ajouté Ajouté dans le changelog. label Dec 10, 2024
@xavfernandez xavfernandez self-assigned this Dec 10, 2024
@xavfernandez xavfernandez force-pushed the xfernandez/mass_action branch 6 times, most recently from 2d161d7 to a7a5fae Compare December 12, 2024 13:21
@xavfernandez xavfernandez added the 1-recette-jetable [Payé à l’heure] Crée une recette jetable sur CC label Dec 12, 2024
@github-actions GitHub Actions
Copy link

🥁 La recette jetable est prête ! 👉 Je veux tester cette PR !

@xavfernandez xavfernandez force-pushed the xfernandez/mass_action branch 2 times, most recently from ec04e9e to 7cc3864 Compare December 13, 2024 10:16
github-advanced-security[bot]
github-advanced-security bot found potential problems Dec 13, 2024
View reviewed changes
itou/www/apply/views/batch_views.py
archived_nb,
",".join(str(app_uid) for app_uid in archived_ids),
)
return HttpResponseRedirect(next_url)

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a
user-provided value
Loading
.

Copilot Autofix AI 1 day ago

To fix the problem, we need to ensure that the next_url is validated before it is used in the HttpResponseRedirect function. We can use Django's url_has_allowed_host_and_scheme function to check that the URL is safe to redirect to. This function ensures that the URL does not contain an explicit host name unless it is in the list of allowed hosts.

  • Modify the transfer function to validate next_url using url_has_allowed_host_and_scheme.
  • If next_url is not valid, redirect to a safe fallback URL.
Suggested changeset 1
itou/www/apply/views/batch_views.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/itou/www/apply/views/batch_views.py b/itou/www/apply/views/batch_views.py
--- a/itou/www/apply/views/batch_views.py
+++ b/itou/www/apply/views/batch_views.py
@@ -10,2 +10,3 @@
 from django.urls import reverse
+from django.utils.http import url_has_allowed_host_and_scheme
 from django.utils import timezone
@@ -434,2 +435,4 @@
     next_url = get_safe_url(request, "next_url", fallback_url=reverse("apply:list_for_siae"))
+    if not url_has_allowed_host_and_scheme(next_url, allowed_hosts=None):
+        next_url = reverse("apply:list_for_siae")
     logger.info(
EOF
@@ -10,2 +10,3 @@
from django.urls import reverse
from django.utils.http import url_has_allowed_host_and_scheme
from django.utils import timezone
@@ -434,2 +435,4 @@
next_url = get_safe_url(request, "next_url", fallback_url=reverse("apply:list_for_siae"))
if not url_has_allowed_host_and_scheme(next_url, allowed_hosts=None):
next_url = reverse("apply:list_for_siae")
logger.info(
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
@xavfernandez xavfernandez force-pushed the xfernandez/mass_action branch from 86197bb to f61e6cc Compare December 13, 2024 16:30
@xavfernandez xavfernandez force-pushed the xfernandez/mass_action branch 2 times, most recently from c48a175 to 7aa8731 Compare December 16, 2024 13:40
@xavfernandez xavfernandez force-pushed the xfernandez/mass_action branch 3 times, most recently from bbdd791 to 81e4c07 Compare December 18, 2024 10:02
@xavfernandez xavfernandez force-pushed the xfernandez/mass_action branch 6 times, most recently from 14bb543 to a55404b Compare December 20, 2024 10:40
github-advanced-security[bot]
github-advanced-security bot found potential problems Dec 20, 2024
View reviewed changes
itou/www/apply/views/batch_views.py
",".join(str(app_uid) for app_uid in postponed_ids),
)
next_url = get_safe_url(request, "next_url", fallback_url=reverse("apply:list_for_siae"))
return HttpResponseRedirect(next_url)

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a
user-provided value
Loading
.
@xavfernandez xavfernandez force-pushed the xfernandez/mass_action branch from 5f7e775 to 36466b2 Compare December 23, 2024 10:41
@xavfernandez xavfernandez force-pushed the xfernandez/mass_action branch from ea788af to 1d915a7 Compare January 10, 2025 10:21
@xavfernandez xavfernandez force-pushed the xfernandez/mass_action branch from 1d915a7 to 668f271 Compare January 10, 2025 10:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@xavfernandez xavfernandez

Labels
1-recette-jetable [Payé à l’heure] Crée une recette jetable sur CC ajouté Ajouté dans le changelog.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@xavfernandez