Skip to content

Commit

Permalink
Hardcode redirect path
Browse files Browse the repository at this point in the history
  • Loading branch information
rnovak338 committed Oct 10, 2024
1 parent ad9a04d commit 29ab44b
Showing 1 changed file with 8 additions and 6 deletions.
14 changes: 8 additions & 6 deletions backend/report_submission/views.py
Original file line number Diff line number Diff line change
Expand Up @@ -577,14 +577,16 @@ def get(self, request, *args, **kwargs):

def post(self, request, *args, **kwargs):
report_id = kwargs["report_id"]
path_name = request.path.split("/")[2]
section = self.additional_context[path_name]
redirect_uri = f"/report_submission/{section['view_id']}/{report_id}"
try:
sac = SingleAuditChecklist.objects.get(report_id=report_id)
accesses = Access.objects.filter(sac=sac, user=request.user)

if not accesses:
messages.error(request, "You do not have access to this audit.")
return redirect(request.path)
path_name = request.path.split("/")[2]
section = self.additional_context[path_name]
return redirect(redirect_uri)

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a
user-provided value
.

try:
excel_files = ExcelFile.objects.filter(
Expand All @@ -597,7 +599,7 @@ def post(self, request, *args, **kwargs):
sac.save()
except ExcelFile.DoesNotExist:
messages.error(request, "File not found.")
return redirect(request.path)
return redirect(redirect_uri)

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a
user-provided value
.

SubmissionEvent.objects.create(
sac_id=sac.id,
Expand All @@ -611,9 +613,9 @@ def post(self, request, *args, **kwargs):
except SingleAuditChecklist.DoesNotExist:
logger.error(f"Audit: {report_id} not found")
messages.error(request, "Audit not found.")
return redirect(request.path)
return redirect(redirect_uri)

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a
user-provided value
.

except Exception as e:
logger.error(f"Unexpected error in DeleteFileView post: {str(e)}")
messages.error(request, "An unexpected error occurred.")
return redirect(request.path)
return redirect(redirect_uri)

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a
user-provided value
.

0 comments on commit 29ab44b

Please sign in to comment.