We are very sorry for the inconvenience, but due to a security vulnerability, password reset is currently disabled until the vulnerability can be patched.
-
If you are locked out of your account, please contact an administrator and we can manually perform a reset
-{% endblock %}
\ No newline at end of file
diff --git a/RIGS/templatetags/filters.py b/RIGS/templatetags/filters.py
index a90ecd64..60b7117d 100644
--- a/RIGS/templatetags/filters.py
+++ b/RIGS/templatetags/filters.py
@@ -2,10 +2,24 @@ from django import template
from django import forms
from django.forms.forms import NON_FIELD_ERRORS
from django.forms.utils import ErrorDict
+from django.utils.text import normalize_newlines
+from django.template.defaultfilters import stringfilter
+from django.utils.safestring import SafeData, mark_safe
+from django.utils.html import escape
register = template.Library()
+@register.filter(is_safe=True, needs_autoescape=True)
+@stringfilter
+def linebreaksxml(value, autoescape=True):
+ autoescape = autoescape and not isinstance(value, SafeData)
+ value = normalize_newlines(value)
+ if autoescape:
+ value = escape(value)
+ return mark_safe(value.replace('\n', ' '))
+
+
@register.filter
def multiply(value, arg):
return value * arg
diff --git a/RIGS/test_functional.py b/RIGS/test_functional.py
index df4863c1..c40e9592 100644
--- a/RIGS/test_functional.py
+++ b/RIGS/test_functional.py
@@ -94,7 +94,8 @@ class UserRegistrationTest(LiveServerTestCase):
# Read what the error is
alert = self.browser.find_element_by_css_selector(
'div.alert-danger').text
- self.assertIn("password fields didn't match", alert)
+ # TODO Use regex matching to handle smart/unsmart quotes...
+ self.assertIn("password fields didn", alert)
# Passwords should be empty
self.assertEqual(password1.get_attribute('value'), '')
@@ -121,7 +122,7 @@ class UserRegistrationTest(LiveServerTestCase):
email = mail.outbox[0]
self.assertIn('John Smith "JS" activation required', email.subject)
urls = re.findall(
- 'http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+', email.body)
+ r'http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+', email.body)
self.assertEqual(len(urls), 1)
mail.outbox = [] # empty this for later
@@ -504,8 +505,10 @@ class EventTest(LiveServerTestCase):
# Add item
form.find_element_by_xpath('//button[contains(@class, "item-add")]').click()
- wait.until(animation_is_finished())
modal = self.browser.find_element_by_id("itemModal")
+ wait.until(animation_is_finished())
+ # See modal has opened
+ self.assertTrue(modal.is_displayed())
modal.find_element_by_id("item_name").send_keys("Test Item 3")
modal.find_element_by_id("item_description").send_keys(
"This is an item description\nthat for reasons unknown spans two lines")
diff --git a/RIGS/test_models.py b/RIGS/test_models.py
index d35cbbe2..1f97e9cd 100644
--- a/RIGS/test_models.py
+++ b/RIGS/test_models.py
@@ -424,7 +424,7 @@ class RIGSVersionTestCase(TestCase):
def test_find_parent_version(self):
# Find the most recent version
- currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest(field_name='revision__date_created')
+ currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest('revision__date_created')
self.assertEqual(currentVersion._object_version.object.notes, "A new note on the event")
# Check the prev version is loaded correctly
@@ -436,7 +436,7 @@ class RIGSVersionTestCase(TestCase):
def test_changes_since(self):
# Find the most recent version
- currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest(field_name='revision__date_created')
+ currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest('revision__date_created')
changes = currentVersion.changes
self.assertEqual(len(changes.field_changes), 1)
@@ -453,7 +453,7 @@ class RIGSVersionTestCase(TestCase):
self.event.save()
# Find the most recent version
- currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest(field_name='revision__date_created')
+ currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest('revision__date_created')
diff = currentVersion.changes
# There are two changes
@@ -475,7 +475,7 @@ class RIGSVersionTestCase(TestCase):
self.person.save()
# Find the most recent version
- currentVersion = versioning.RIGSVersion.objects.get_for_object(self.person).latest(field_name='revision__date_created')
+ currentVersion = versioning.RIGSVersion.objects.get_for_object(self.person).latest('revision__date_created')
diff = currentVersion.changes
# Should be declared as long
@@ -488,7 +488,7 @@ class RIGSVersionTestCase(TestCase):
self.event.save()
# Find the most recent version
- currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest(field_name='revision__date_created')
+ currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest('revision__date_created')
# Check the diff is correct
self.assertEqual(currentVersion.changes.field_changes[0].diff,
@@ -504,12 +504,12 @@ class RIGSVersionTestCase(TestCase):
self.event.status = models.Event.CONFIRMED
self.event.save()
- currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest(field_name='revision__date_created')
+ currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest('revision__date_created')
self.assertEqual(currentVersion.changes.field_changes[0].old, 'Provisional')
self.assertEqual(currentVersion.changes.field_changes[0].new, 'Confirmed')
def test_creation_behaviour(self):
- firstVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest(field_name='revision__date_created').parent
+ firstVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest('revision__date_created').parent
diff = firstVersion.changes
# Mainly to check for exceptions:
@@ -522,7 +522,7 @@ class RIGSVersionTestCase(TestCase):
self.event.save()
# Find the most recent version
- currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest(field_name='revision__date_created')
+ currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest('revision__date_created')
diffs = currentVersion.changes.item_changes
@@ -541,7 +541,7 @@ class RIGSVersionTestCase(TestCase):
item1.save()
self.event.save()
- currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest(field_name='revision__date_created')
+ currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest('revision__date_created')
diffs = currentVersion.changes.item_changes
@@ -563,7 +563,7 @@ class RIGSVersionTestCase(TestCase):
self.event.save()
# Find the most recent version
- currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest(field_name='revision__date_created')
+ currentVersion = versioning.RIGSVersion.objects.get_for_object(self.event).latest('revision__date_created')
diffs = currentVersion.changes.item_changes
diff --git a/RIGS/test_unit.py b/RIGS/test_unit.py
index fb89cfb7..5d5d79cb 100644
--- a/RIGS/test_unit.py
+++ b/RIGS/test_unit.py
@@ -226,7 +226,7 @@ class TestPrintPaperwork(TestCase):
cls.vatrate = models.VatRate.objects.create(start_at='2014-03-05', rate=0.20, comment='test1')
cls.events = {
- 1: models.Event.objects.create(name="TE E1", start_date=date.today()),
+ 1: models.Event.objects.create(name="TE E1", start_date=date.today(), description="This is an event description\nthat for a very specific reason spans two lines."),
}
cls.invoices = {
diff --git a/RIGS/urls.py b/RIGS/urls.py
index 006270c9..98a5c9e7 100644
--- a/RIGS/urls.py
+++ b/RIGS/urls.py
@@ -1,7 +1,9 @@
+from django.urls import path
from django.conf.urls import url
-from django.contrib.auth.views import password_reset
+from django.contrib.auth.views import PasswordResetView
from django.contrib.auth.decorators import login_required
+from django.contrib.auth.views import LoginView
from RIGS import models, views, rigboard, finance, ical, versioning, forms
from django.views.generic import RedirectView
from django.views.decorators.clickjacking import xframe_options_exempt
@@ -16,10 +18,8 @@ urlpatterns = [
url('^$', login_required(views.Index.as_view()), name='index'),
url(r'^closemodal/$', views.CloseModal.as_view(), name='closemodal'),
- url('^user/login/$', views.login, name='login'),
- url('^user/login/embed/$', xframe_options_exempt(views.login_embed), name='login_embed'),
-
- url(r'^user/password_reset/$', views.PasswordResetDisabled.as_view()),
+ path('user/login/', LoginView.as_view(authentication_form=forms.CheckApprovedForm), name='login'),
+ path('user/login/embed/', xframe_options_exempt(views.LoginEmbed.as_view()), name='login_embed'),
url(r'^search_help/$', views.SearchHelp.as_view(), name='search_help'),
diff --git a/RIGS/versioning.py b/RIGS/versioning.py
index 9dff4a3e..f9056abf 100644
--- a/RIGS/versioning.py
+++ b/RIGS/versioning.py
@@ -184,8 +184,7 @@ class RIGSVersion(Version):
versions = RIGSVersion.objects.get_for_object_reference(self.content_type.model_class(), thisId).select_related("revision", "revision__user").all()
try:
- previousVersion = versions.filter(revision_id__lt=self.revision_id).latest(
- field_name='revision__date_created')
+ previousVersion = versions.filter(revision_id__lt=self.revision_id).latest('revision__date_created')
except ObjectDoesNotExist:
return False
diff --git a/RIGS/views.py b/RIGS/views.py
index db2c6a2d..ca8bc66e 100644
--- a/RIGS/views.py
+++ b/RIGS/views.py
@@ -3,6 +3,7 @@ from django.http.response import HttpResponseRedirect
from django.http import HttpResponse
from django.urls import reverse_lazy, reverse, NoReverseMatch
from django.views import generic
+from django.contrib.auth.views import LoginView
from django.db.models import Q
from django.shortcuts import get_object_or_404
from django.core import serializers
@@ -34,16 +35,6 @@ class Index(generic.TemplateView):
return context
-def login(request, **kwargs):
- if request.user.is_authenticated:
- next = request.GET.get('next', '/')
- return HttpResponseRedirect(next)
- else:
- from django.contrib.auth.views import login
-
- return login(request, authentication_form=forms.CheckApprovedForm)
-
-
class SearchHelp(generic.TemplateView):
template_name = 'RIGS/search_help.html'
@@ -52,14 +43,11 @@ class SearchHelp(generic.TemplateView):
# Then we can check for it and show a nice error
# Don't worry, django.contrib.auth.views.login will
# check for it before logging the user in
-@csrf_exempt
-def login_embed(request, **kwargs):
- if request.user.is_authenticated:
- next = request.GET.get('next', '/')
- return HttpResponseRedirect(next)
- else:
- from django.contrib.auth.views import login
+class LoginEmbed(LoginView):
+ template_name = 'registration/login_embed.html'
+ @csrf_exempt
+ def dispatch(self, request, *args, **kwargs):
if request.method == "POST":
csrf_cookie = request.COOKIES.get('csrftoken', None)
@@ -67,7 +55,7 @@ def login_embed(request, **kwargs):
messages.warning(request, 'Cookies do not seem to be enabled. Try logging in using a new tab.')
request.method = 'GET' # Render the page without trying to login
- return login(request, template_name="registration/login_embed.html", authentication_form=forms.EmbeddedAuthenticationForm)
+ return super().dispatch(request, *args, **kwargs)
"""
@@ -423,7 +411,3 @@ class ResetApiKey(generic.RedirectView):
self.request.user.save()
return reverse_lazy('profile_detail')
-
-
-class PasswordResetDisabled(generic.TemplateView):
- template_name = "RIGS/password_reset_disable.html"
diff --git a/assets/migrations/0006_auto_20180728_1451_squashed_0021_auto_20190105_1156.py b/assets/migrations/0006_auto_20180728_1451_squashed_0021_auto_20190105_1156.py
index f15341e1..dcf7980e 100644
--- a/assets/migrations/0006_auto_20180728_1451_squashed_0021_auto_20190105_1156.py
+++ b/assets/migrations/0006_auto_20180728_1451_squashed_0021_auto_20190105_1156.py
@@ -57,7 +57,7 @@ class Migration(migrations.Migration):
migrations.AddField(
model_name='asset',
name='parent',
- field=models.ForeignKey(blank=True, null=True, on_delete=None, related_name='asset_parent', to='assets.Asset'),
+ field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='asset_parent', to='assets.Asset'),
),
migrations.RemoveField(
model_name='asset',
@@ -85,7 +85,7 @@ class Migration(migrations.Migration):
('circuits', models.IntegerField(blank=True, null=True)),
('cores', models.IntegerField(blank=True, null=True)),
('category', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='assets.AssetCategory')),
- ('parent', models.ForeignKey(blank=True, null=True, on_delete=None, related_name='asset_parent', to='assets.Cable')),
+ ('parent', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='asset_parent', to='assets.Cable')),
],
options={
'abstract': False,
diff --git a/assets/migrations/0010_auto_20200207_1737.py b/assets/migrations/0010_auto_20200207_1737.py
deleted file mode 100644
index 6ffeb824..00000000
--- a/assets/migrations/0010_auto_20200207_1737.py
+++ /dev/null
@@ -1,17 +0,0 @@
-# Generated by Django 2.0.13 on 2020-02-07 17:37
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-
- dependencies = [
- ('assets', '0009_auto_20200103_2215'),
- ]
-
- operations = [
- migrations.AlterModelOptions(
- name='supplier',
- options={'ordering': ['name'], 'permissions': (('view_supplier', 'Can view a supplier'),)},
- ),
- ]
diff --git a/assets/migrations/0010_auto_20200219_1444.py b/assets/migrations/0010_auto_20200219_1444.py
new file mode 100644
index 00000000..fe5744f4
--- /dev/null
+++ b/assets/migrations/0010_auto_20200219_1444.py
@@ -0,0 +1,21 @@
+# Generated by Django 3.0.3 on 2020-02-19 14:44
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+ dependencies = [
+ ('assets', '0009_auto_20200103_2215'),
+ ]
+
+ operations = [
+ migrations.AlterModelOptions(
+ name='asset',
+ options={'ordering': ['asset_id_prefix', 'asset_id_number'], 'permissions': [('asset_finance', 'Can see financial data for assets')]},
+ ),
+ migrations.AlterModelOptions(
+ name='supplier',
+ options={'ordering': ['name']},
+ ),
+ ]
diff --git a/assets/models.py b/assets/models.py
index 5bf830bc..a6c767f1 100644
--- a/assets/models.py
+++ b/assets/models.py
@@ -41,13 +41,10 @@ class AssetStatus(models.Model):
@reversion.register
class Supplier(models.Model, RevisionMixin):
- name = models.CharField(max_length=80)
-
class Meta:
ordering = ['name']
- permissions = (
- ('view_supplier', 'Can view a supplier'),
- )
+
+ name = models.CharField(max_length=80)
def get_absolute_url(self):
return reverse('supplier_list')
@@ -70,10 +67,9 @@ class Connector(models.Model):
class Asset(models.Model, RevisionMixin):
class Meta:
ordering = ['asset_id_prefix', 'asset_id_number']
- permissions = (
- ('asset_finance', 'Can see financial data for assets'),
- ('view_asset', 'Can view an asset')
- )
+ permissions = [
+ ('asset_finance', 'Can see financial data for assets')
+ ]
parent = models.ForeignKey(to='self', related_name='asset_parent',
blank=True, null=True, on_delete=models.SET_NULL)
diff --git a/assets/templates/asset_embed.html b/assets/templates/asset_embed.html
index c4a40187..2d98a541 100644
--- a/assets/templates/asset_embed.html
+++ b/assets/templates/asset_embed.html
@@ -1,8 +1,7 @@
{% extends 'base_embed.html' %}
-{% load static from staticfiles %}
+{% load static %}
{% block content %}
-