mirror of
https://github.com/eitchtee/WYGIWYH.git
synced 2026-11-13 12:23:44 +01:00
Herculino Trotta
1e486a608e
ImportProfile and ImportRun had no owner, and neither the web views nor the REST viewsets filtered by the requesting user, so any authenticated user could read, edit and delete every other user's import profiles and runs (GHSA-q668-h56g-mfp4). - ImportProfile is now a SharedObject, with share and take-ownership views like transaction rules; the global unique constraint on name is dropped. - ImportRun is now an OwnedObject owned by the uploader, so runs made with a shared profile stay private to whoever ran them. - Existing runs are backfilled with the owner of their imported transactions; existing profiles stay unowned and usable by everyone.
66 lines
1.7 KiB
Python
66 lines
1.7 KiB
Python
from django.urls import path
|
|
import apps.import_app.views as views
|
|
|
|
urlpatterns = [
|
|
path(
|
|
"import/presets/",
|
|
views.import_presets_list,
|
|
name="import_presets_list",
|
|
),
|
|
path(
|
|
"import/profiles/",
|
|
views.import_profile_index,
|
|
name="import_profiles_index",
|
|
),
|
|
path(
|
|
"import/profiles/list/",
|
|
views.import_profile_list,
|
|
name="import_profiles_list",
|
|
),
|
|
path(
|
|
"import/profiles/<int:profile_id>/delete/",
|
|
views.import_profile_delete,
|
|
name="import_profile_delete",
|
|
),
|
|
path(
|
|
"import/profiles/add/",
|
|
views.import_profile_add,
|
|
name="import_profiles_add",
|
|
),
|
|
path(
|
|
"import/profiles/<int:profile_id>/edit/",
|
|
views.import_profile_edit,
|
|
name="import_profile_edit",
|
|
),
|
|
path(
|
|
"import/profiles/<int:profile_id>/take-ownership/",
|
|
views.import_profile_take_ownership,
|
|
name="import_profile_take_ownership",
|
|
),
|
|
path(
|
|
"import/profiles/<int:pk>/share/",
|
|
views.import_profile_share,
|
|
name="import_profile_share_settings",
|
|
),
|
|
path(
|
|
"import/profiles/<int:profile_id>/runs/list/",
|
|
views.import_runs_list,
|
|
name="import_profile_runs_list",
|
|
),
|
|
path(
|
|
"import/profiles/<int:profile_id>/runs/<int:run_id>/log/",
|
|
views.import_run_log,
|
|
name="import_run_log",
|
|
),
|
|
path(
|
|
"import/profiles/<int:profile_id>/runs/<int:run_id>/delete/",
|
|
views.import_run_delete,
|
|
name="import_run_delete",
|
|
),
|
|
path(
|
|
"import/profiles/<int:profile_id>/runs/add/",
|
|
views.import_run_add,
|
|
name="import_run_add",
|
|
),
|
|
]
|