Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit d206a7e

Browse files
Unnati-Gupta24Unnati-Gupta24
committedFeb 12, 2025
[BUG] uuid pattern change and pattern checking #682 
1 parent 129a42f commit d206a7e

File tree

4 files changed

+40
-32
lines changed

4 files changed

+40
-32
lines changed
 

‎openwisp_controller/config/admin.py

+8-2
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,11 @@ def get_extra_context(self, pk=None):
136136
if not issubclass(self.model, AbstractVpn):
137137
ctx['CONFIG_BACKEND_FIELD_SHOWN'] = app_settings.CONFIG_BACKEND_FIELD_SHOWN
138138
if pk:
139+
UUID_PATTERN = re.compile(
140+
'^[a-fA-F0-9]{8}-?[a-fA-F0-9]{4}-?[a-fA-F0-9]{4}-?[a-fA-F0-9]{4}-?[a-fA-F0-9]{12}$'
141+
)
142+
if not UUID_PATTERN.match(str(pk)):
143+
raise Http404()
139144
ctx['download_url'] = reverse('{0}_download'.format(prefix), args=[pk])
140145
try:
141146
has_config = True
@@ -165,9 +170,10 @@ def change_view(self, request, object_id, form_url='', extra_context=None):
165170
def get_urls(self):
166171
options = getattr(self.model, '_meta')
167172
url_prefix = '{0}_{1}'.format(options.app_label, options.model_name)
173+
UUID_PATTERN = r'([a-fA-F0-9]{8}-?[a-fA-F0-9]{4}-?[a-fA-F0-9]{4}-?[a-fA-F0-9]{4}-?[a-fA-F0-9]{12})'
168174
return [
169175
re_path(
170-
r'^download/(?P<pk>[^/]+)/$',
176+
r'^download/{0}/$'.format(UUID_PATTERN),
171177
self.admin_site.admin_view(self.download_view),
172178
name='{0}_download'.format(url_prefix),
173179
),
@@ -177,7 +183,7 @@ def get_urls(self):
177183
name='{0}_preview'.format(url_prefix),
178184
),
179185
re_path(
180-
r'^(?P<pk>[^/]+)/context\.json$',
186+
r'^{0}/context\.json$'.format(UUID_PATTERN),
181187
self.admin_site.admin_view(self.context_view),
182188
name='{0}_context'.format(url_prefix),
183189
),

‎openwisp_controller/config/tests/pytest.py

+20-19
Original file line numberDiff line numberDiff line change
@@ -11,21 +11,22 @@
1111
from ..base.channels_consumer import BaseDeviceConsumer
1212
from .utils import CreateDeviceMixin
1313

14-
Device = load_model('config', 'Device')
14+
Device = load_model("config", "Device")
1515

1616

1717
@pytest.mark.asyncio
1818
@pytest.mark.django_db(transaction=True)
1919
class TestDeviceConsumer(CreateDeviceMixin):
2020
model = Device
21+
UUID_PATTERN = "[a-fA-F0-9]{8}-?[a-fA-F0-9]{4}-?[a-fA-F0-9]{4}-?[a-fA-F0-9]{4}-?[a-fA-F0-9]{12}"
2122
application = ProtocolTypeRouter(
2223
{
23-
'websocket': AllowedHostsOriginValidator(
24+
"websocket": AllowedHostsOriginValidator(
2425
AuthMiddlewareStack(
2526
URLRouter(
2627
[
2728
re_path(
28-
r'^ws/controller/device/(?P<pk>[^/]+)/$',
29+
f"^ws/controller/device/(?P<pk>{UUID_PATTERN})/$",
2930
BaseDeviceConsumer.as_asgi(),
3031
)
3132
]
@@ -36,34 +37,34 @@ class TestDeviceConsumer(CreateDeviceMixin):
3637
)
3738

3839
async def _get_communicator(self, admin_client, device_id):
39-
session_id = admin_client.cookies['sessionid'].value
40-
communicator = WebsocketCommunicator(
40+
session_id = admin_client.cookies["sessionid"].value
41+
communicator = WebsocketCommunicator(
4142
self.application,
42-
path=f'ws/controller/device/{device_id}/',
43+
path=f"ws/controller/device/{device_id}/",
4344
headers=[
4445
(
45-
b'cookie',
46-
f'sessionid={session_id}'.encode('ascii'),
46+
b"cookie",
47+
f"sessionid={session_id}".encode("ascii"),
4748
)
4849
],
4950
)
50-
connected, subprotocol = await communicator.connect()
51-
assert connected is True
52-
return communicator
51+
connected, subprotocol = await communicator.connect()
52+
assert connected is True
53+
return communicator
5354

5455
@database_sync_to_async
5556
def _add_model_permissions(self, user, add=True, change=True, delete=True):
5657
permissions = []
5758
if add:
58-
permissions.append(f'add_{self.model._meta.model_name}')
59+
permissions.append(f"add_{self.model._meta.model_name}")
5960
if change:
60-
permissions.append(f'change_{self.model._meta.model_name}')
61+
permissions.append(f"change_{self.model._meta.model_name}")
6162
if delete:
62-
permissions.append(f'delete_{self.model._meta.model_name}')
63+
permissions.append(f"delete_{self.model._meta.model_name}")
6364
user.user_permissions.set(Permission.objects.filter(codename__in=permissions))
6465

6566
async def test_unauthenticated_user(self, client):
66-
client.cookies['sessionid'] = 'random'
67+
client.cookies["sessionid"] = "random"
6768
device = await database_sync_to_async(self._create_device)()
6869
with pytest.raises(AssertionError):
6970
await self._get_communicator(client, device.id)
@@ -91,14 +92,14 @@ async def test_user_authorization(self, client, django_user_model):
9192

9293
async def test_silent_disconnection(self, admin_user, admin_client):
9394
device = await database_sync_to_async(self._create_device)()
94-
session_id = admin_client.cookies['sessionid'].value
95+
session_id = admin_client.cookies["sessionid"].value
9596
communicator = WebsocketCommunicator(
9697
self.application,
97-
path=f'ws/controller/device/{device.pk}/',
98+
path=f"ws/controller/device/{device.pk}/",
9899
headers=[
99100
(
100-
b'cookie',
101-
f'sessionid={session_id}'.encode('ascii'),
101+
b"cookie",
102+
f"sessionid={session_id}".encode("ascii"),
102103
)
103104
],
104105
)

‎openwisp_controller/config/utils.py

+10-10
Original file line numberDiff line numberDiff line change
@@ -116,22 +116,22 @@ def get_controller_urls(views_module):
116116
"""
117117
urls = [
118118
re_path(
119-
'controller/device/checksum/(?P<pk>[^/]+)/$',
119+
f'controller/device/checksum/(?P<pk>{UUID_PATTERN})/$',
120120
views_module.device_checksum,
121121
name='device_checksum',
122122
),
123123
re_path(
124-
'controller/device/download-config/(?P<pk>[^/]+)/$',
124+
f'controller/device/download-config/(?P<pk>{UUID_PATTERN})/$',
125125
views_module.device_download_config,
126126
name='device_download_config',
127127
),
128128
re_path(
129-
'controller/device/update-info/(?P<pk>[^/]+)/$',
129+
f'controller/device/update-info/(?P<pk>{UUID_PATTERN})/$',
130130
views_module.device_update_info,
131131
name='device_update_info',
132132
),
133133
re_path(
134-
'controller/device/report-status/(?P<pk>[^/]+)/$',
134+
f'controller/device/report-status/(?P<pk>{UUID_PATTERN})/$',
135135
views_module.device_report_status,
136136
name='device_report_status',
137137
),
@@ -141,33 +141,33 @@ def get_controller_urls(views_module):
141141
name='device_register',
142142
),
143143
re_path(
144-
'controller/vpn/checksum/(?P<pk>[^/]+)/$',
144+
f'controller/vpn/checksum/(?P<pk>{UUID_PATTERN})/$',
145145
views_module.vpn_checksum,
146146
name='vpn_checksum',
147147
),
148148
re_path(
149-
'controller/vpn/download-config/(?P<pk>[^/]+)/$',
149+
f'controller/vpn/download-config/(?P<pk>{UUID_PATTERN})/$',
150150
views_module.vpn_download_config,
151151
name='vpn_download_config',
152152
),
153153
# legacy URLs
154154
re_path(
155-
'controller/checksum/(?P<pk>[^/]+)/$',
155+
f'controller/checksum/(?P<pk>{UUID_PATTERN})/$',
156156
views_module.device_checksum,
157157
name='checksum_legacy',
158158
),
159159
re_path(
160-
'controller/download-config/(?P<pk>[^/]+)/$',
160+
f'controller/download-config/(?P<pk>{UUID_PATTERN})/$',
161161
views_module.device_download_config,
162162
name='download_config_legacy',
163163
),
164164
re_path(
165-
'controller/update-info/(?P<pk>[^/]+)/$',
165+
f'controller/update-info/(?P<pk>{UUID_PATTERN})/$',
166166
views_module.device_update_info,
167167
name='update_info_legacy',
168168
),
169169
re_path(
170-
'controller/report-status/(?P<pk>[^/]+)/$',
170+
f'controller/report-status/(?P<pk>{UUID_PATTERN})/$',
171171
views_module.device_report_status,
172172
name='report_status_legacy',
173173
),

‎openwisp_controller/connection/channels/routing.py

+2-1
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,10 @@
44

55

66
def get_routes(consumer=ow_consumer):
7+
UUID_PATTERN = '[a-fA-F0-9]{8}-?[a-fA-F0-9]{4}-?[a-fA-F0-9]{4}-?[a-fA-F0-9]{4}-?[a-fA-F0-9]{12}'
78
return [
89
re_path(
9-
r'^ws/controller/device/(?P<pk>[^/]+)/command$',
10+
f'^ws/controller/device/(?P<pk>{UUID_PATTERN})/command$',
1011
consumer.CommandConsumer.as_asgi(),
1112
)
1213
]

0 commit comments

Comments
 (0)
Please sign in to comment.