-
Notifications
You must be signed in to change notification settings - Fork 843
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Solution #885
base: master
Are you sure you want to change the base?
Solution #885
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -10,6 +10,10 @@ jobs: | |
runs-on: ubuntu-latest | ||
timeout-minutes: 10 | ||
|
||
env: | ||
SECRET_KEY: "django-insecure-8ovil3xu6=eaoqd#-#&ricv159p0pypoh5_lgm*)-dfcjqe=yc" | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Security Concern: Hardcoding the |
||
DEBUG: "False" | ||
|
||
steps: | ||
- name: Checkout repo | ||
uses: actions/checkout@v2 | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,14 @@ | ||
from django import forms | ||
from .models import Car, Manufacturer | ||
|
||
|
||
class CarForm(forms.ModelForm): | ||
class Meta: | ||
model = Car | ||
fields = "__all__" | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Using There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Form Field Exposure: Using |
||
|
||
|
||
class ManufacturerForm(forms.ModelForm): | ||
class Meta: | ||
model = Manufacturer | ||
fields = "__all__" | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Similar to the CarForm, using There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Form Field Exposure: Similar to the CarForm, using |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,8 +1,11 @@ | ||
from django.urls import reverse_lazy | ||
|
||
from django.contrib.auth.decorators import login_required | ||
from django.shortcuts import render | ||
from django.views import generic | ||
from django.contrib.auth.mixins import LoginRequiredMixin | ||
|
||
from .forms import ManufacturerForm, CarForm | ||
from .models import Driver, Car, Manufacturer | ||
|
||
|
||
|
@@ -34,12 +37,50 @@ class ManufacturerListView(LoginRequiredMixin, generic.ListView): | |
paginate_by = 5 | ||
|
||
|
||
class ManufacturerCreateView(LoginRequiredMixin, generic.CreateView): | ||
form_class = ManufacturerForm | ||
success_url = reverse_lazy("taxi:manufacturer-list") | ||
template_name = "taxi/manufacturer_form.html" | ||
|
||
|
||
class ManufacturerUpdateView(LoginRequiredMixin, generic.UpdateView): | ||
form_class = ManufacturerForm | ||
success_url = reverse_lazy("taxi:manufacturer-list") | ||
template_name = "taxi/manufacturer_form.html" | ||
queryset = Manufacturer.objects.all() | ||
|
||
|
||
class ManufacturerDeleteView(LoginRequiredMixin, generic.DeleteView): | ||
model = Manufacturer | ||
template_name = "taxi/manufacturer_confirm_delete.html" | ||
success_url = reverse_lazy("taxi:manufacturer-list") | ||
|
||
|
||
class CarListView(LoginRequiredMixin, generic.ListView): | ||
model = Car | ||
paginate_by = 5 | ||
queryset = Car.objects.all().select_related("manufacturer") | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The use of |
||
|
||
|
||
class CarCreateView(LoginRequiredMixin, generic.CreateView): | ||
form_class = CarForm | ||
success_url = reverse_lazy("taxi:car-list") | ||
template_name = "taxi/car_form.html" | ||
|
||
|
||
class CarUpdateView(LoginRequiredMixin, generic.UpdateView): | ||
form_class = CarForm | ||
success_url = reverse_lazy("taxi:car-list") | ||
template_name = "taxi/car_form.html" | ||
queryset = Car.objects.all().select_related("manufacturer") | ||
|
||
|
||
class CarDeleteView(LoginRequiredMixin, generic.DeleteView): | ||
model = Car | ||
template_name = "taxi/car_confirm_delete.html" | ||
success_url = reverse_lazy("taxi:car-list") | ||
|
||
|
||
class CarDetailView(LoginRequiredMixin, generic.DetailView): | ||
model = Car | ||
|
||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -9,8 +9,10 @@ | |
For the full list of settings and their values, see | ||
https://docs.djangoproject.com/en/4.0/ref/settings/ | ||
""" | ||
|
||
import os | ||
from pathlib import Path | ||
from dotenv import load_dotenv | ||
load_dotenv() | ||
|
||
# Build paths inside the project like this: BASE_DIR / "subdir". | ||
BASE_DIR = Path(__file__).resolve().parent.parent | ||
|
@@ -20,12 +22,10 @@ | |
# See https://docs.djangoproject.com/en/4.0/howto/deployment/checklist/ | ||
|
||
# SECURITY WARNING: keep the secret key used in production secret! | ||
SECRET_KEY = ( | ||
"django-insecure-8ovil3xu6=eaoqd#-#&ricv159p0pypoh5_lgm*)-dfcjqe=yc" | ||
) | ||
SECRET_KEY = os.environ.get("SECRET_KEY") | ||
|
||
# SECURITY WARNING: don"t run with debug turned on in production! | ||
DEBUG = True | ||
DEBUG = os.environ.get("DEBUG") == "True" | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Ensure that the |
||
|
||
ALLOWED_HOSTS = [] | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Production Settings: The |
||
|
||
|
@@ -44,6 +44,8 @@ | |
"django.contrib.staticfiles", | ||
"debug_toolbar", | ||
"taxi", | ||
"crispy_forms", | ||
"crispy_bootstrap4" | ||
] | ||
|
||
MIDDLEWARE = [ | ||
|
@@ -140,3 +142,5 @@ | |
# https://docs.djangoproject.com/en/4.0/ref/settings/#default-auto-field | ||
|
||
DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField" | ||
|
||
CRISPY_TEMPLATE_PACK = "bootstrap4" |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
{% extends "base.html" %} | ||
|
||
{% block content %} | ||
<h1>Delete Car</h1> | ||
|
||
<p>Are you sure you want to delete <strong>{{ car }}</strong>?</p> | ||
<form action="" method="post"> | ||
{% csrf_token %} | ||
<input type="submit" value="Yes, delete" class="btn btn-danger"> | ||
</form> | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consider adding a cancel button or link to allow users to navigate away from the delete confirmation page without taking action. This improves user experience by providing an easy way to cancel the operation. |
||
{% endblock %} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
{% extends "base.html" %} | ||
{% load crispy_forms_filters %} | ||
{% block content %} | ||
<h1>Create Car</h1> | ||
<form action="" method="post"> | ||
{% csrf_token %} | ||
{{ form|crispy }} | ||
{# {{ form.as_p }}#} | ||
<input type="submit" value="Submit"> | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consider adding Bootstrap classes to the submit button for styling consistency, such as |
||
</form> | ||
{% endblock %} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,12 @@ | ||
{% extends "base.html" %} | ||
|
||
{% block content %} | ||
<h1>Delete Manufacturer</h1> | ||
|
||
<p>Are you sure you want to delete <strong>{{ manufacturer }}</strong>?</p> | ||
<p><i>All cars from that manufacturer will be also deleted!</i></p> | ||
<form action="" method="post"> | ||
{% csrf_token %} | ||
<input type="submit" value="Yes, delete" class="btn btn-danger"> | ||
</form> | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consider adding a cancel button or link to allow users to navigate away from the delete confirmation page without taking action. This improves user experience by providing an easy way to cancel the operation. |
||
{% endblock %} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
{% extends "base.html" %} | ||
{% load crispy_forms_filters %} | ||
{% block content %} | ||
<h1>Create Manufacturer</h1> | ||
<form action="" method="post"> | ||
{% csrf_token %} | ||
{{ form|crispy }} | ||
{# {{ form.as_p }}#} | ||
<input type="submit" value="Submit"> | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consider adding Bootstrap classes to the submit button for styling consistency, such as |
||
</form> | ||
{% endblock %} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,7 +1,7 @@ | ||
{% extends "base.html" %} | ||
|
||
{% block content %} | ||
<h1>Manufacturer List | ||
<h1>Manufacturer List <a href="{% url "taxi:manufacturer-create" %}">+</a> | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consider adding Bootstrap classes to the '+' link to make it more visually appealing and consistent with other buttons or links in the application, such as |
||
</h1> | ||
|
||
{% if manufacturer_list %} | ||
|
@@ -10,18 +10,26 @@ <h1>Manufacturer List | |
<th>ID</th> | ||
<th>Name</th> | ||
<th>Country</th> | ||
<th>Update</th> | ||
<th>Delete</th> | ||
</tr> | ||
|
||
{% for manufacturer in manufacturer_list %} | ||
<tr> | ||
<td> | ||
{{ manufacturer.id }} | ||
{{ manufacturer.id }} | ||
</td> | ||
<td> | ||
{{ manufacturer.name }} | ||
{{ manufacturer.name }} | ||
</td> | ||
<td> | ||
{{ manufacturer.country }} | ||
{{ manufacturer.country }} | ||
</td> | ||
<td> | ||
<a href="{% url "taxi:manufacturer-update" pk=manufacturer.id %}">Update</a> | ||
</td> | ||
<td> | ||
<a href="{% url "taxi:manufacturer-delete" pk=manufacturer.id %}">DELETE</a> | ||
</td> | ||
</tr> | ||
{% endfor %} | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's a security issue to hardcode sensitive information like
SECRET_KEY
in your configuration files. Consider using GitHub Secrets to store this value securely and reference it in your workflow.