Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixed all the errors for django==4.0 version #88

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

Fixed all the errors for django==4.0 version #88

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions admin_honeypot/admin.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
from django.contrib import admin
from django.utils.html import format_html
from django.utils.translation import gettext_lazy as _

from admin_honeypot.models import LoginAttempt
Expand All @@ -18,16 +17,19 @@ def get_actions(self, request):
return actions

def get_session_key(self, instance):
return format_html('<a href="?session_key={sk}">{sk}</a>', sk=instance.session_key)
return '<a href="?session_key=%(key)s">%(key)s</a>' % {'key': instance.session_key}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I really don't like these changes.

Reading up on the rationale for using format_html, it would seem to prevent XSS attacks, and is easier to use than % string interpolation.

For the case of building up small HTML fragments, this function is to be preferred over string interpolation using % or str.format() directly, because it applies escaping to all arguments - just like the template system applies escaping by default.

So, instead of writing:

mark_safe(
    "%s <b>%s</b> %s"
    % (
        some_html,
        escape(some_text),
        escape(some_other_text),
    )
)

You should instead use:

format_html(
    "{} <b>{}</b> {}",
    mark_safe(some_html),
    some_text,
    some_other_text,
)

This has the advantage that you don’t need to apply escape() to each argument and risk a bug and an XSS vulnerability if you forget one.

get_session_key.short_description = _('Session')
get_session_key.allow_tags = True

def get_ip_address(self, instance):
return format_html('<a href="?ip_address={ip}">{ip}</a>', ip=instance.ip_address)
return '<a href="?ip_address=%(ip)s">%(ip)s</a>' % {'ip': instance.ip_address}
get_ip_address.short_description = _('IP Address')
get_ip_address.allow_tags = True

def get_path(self, instance):
return format_html('<a href="?path={path}">{path}</a>', path=instance.path)
return '<a href="?path=%(path)s">%(path)s</a>' % {'path': instance.path}
get_path.short_description = _('URL')
get_path.allow_tags = True

def has_add_permission(self, request, obj=None):
return False
Expand Down
20 changes: 20 additions & 0 deletions admin_honeypot/models.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,26 @@
from admin_honeypot import listeners


class LoginAttempt(models.Model):
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this model was accidentally copied and pasted here. It's a duplicate of the model defined on 26, and usually people try to keep import statements above other code, including model and class definitions.

username = models.CharField(_("username"), max_length=255, blank=True, null=True)
ip_address = models.GenericIPAddressField(_("ip address"), protocol='both', blank=True, null=True)
session_key = models.CharField(_("session key"), max_length=50, blank=True, null=True)
user_agent = models.TextField(_("user-agent"), blank=True, null=True)
timestamp = models.DateTimeField(_("timestamp"), auto_now_add=True)
path = models.TextField(_("path"), blank=True, null=True)

class Meta:
verbose_name = _("login attempt")
verbose_name_plural = _("login attempts")
ordering = ('timestamp',)

def __str__(self):
return self.username
from django.db import models
from django.utils.translation import gettext_lazy as _
Copy link

@rbtsolis rbtsolis Jan 18, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this import is ok, but just work for Django 4, if anyone is using Django 3, this is version is not working with it, I think is better import djanngo, and do an if like:

import django


if django.VERSION < (4,):
    from django.utils.translation import ugettext_lazy as _
else:
    from django.utils.translation import gettext_lazy as _

from admin_honeypot import listeners


class LoginAttempt(models.Model):
username = models.CharField(_("username"), max_length=255, blank=True, null=True)
ip_address = models.GenericIPAddressField(_("ip address"), protocol='both', blank=True, null=True)
Expand Down
4 changes: 2 additions & 2 deletions admin_honeypot/signals.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
from django import dispatch
from django.dispatch import Signal

honeypot = dispatch.Signal()
honeypot = Signal('request')
Comment on lines +1 to +3
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would try not to adjust imports if you don't absolutely need to. They make reading a pull request more difficult.

The big change here is adding a string argument named 'request' to the signal. But the Signal class doesn't have an __init__ argument where this would make any sense:

class Signal:
    ...

    def __init__(self, use_caching=False):
        ...

Can you explain a bit more about what you were trying to fix here?

4 changes: 2 additions & 2 deletions admin_honeypot/urls.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
from admin_honeypot import views
from django.urls import path, re_path
from django.urls import re_path

app_name = 'admin_honeypot'

urlpatterns = [
path('login/', views.AdminHoneypot.as_view(), name='login'),
re_path(r'^login/$', views.AdminHoneypot.as_view(), name='login'),
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using the original path is likely going to be faster. Avoid re_path where possible.

re_path(r'^.*$', views.AdminHoneypot.as_view(), name='index'),
]
12 changes: 3 additions & 9 deletions admin_honeypot/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,7 @@
import django

from ipware import get_client_ip

Comment on lines -2 to -4
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why was this removed? It solved a valid problem.

from admin_honeypot.forms import HoneypotLoginForm
from admin_honeypot.models import LoginAttempt
from admin_honeypot.signals import honeypot

from django.contrib.admin.sites import AdminSite
from django.contrib.auth import REDIRECT_FIELD_NAME
from django.contrib.auth.views import redirect_to_login
from django.shortcuts import redirect
Expand Down Expand Up @@ -36,9 +31,9 @@ def get_form(self, form_class=form_class):

def get_context_data(self, **kwargs):
context = super(AdminHoneypot, self).get_context_data(**kwargs)
path = self.request.get_full_path()
context.update({
**AdminSite().each_context(self.request),
'app_path': self.request.get_full_path(),
'app_path': path,
REDIRECT_FIELD_NAME: reverse('admin_honeypot:index'),
'title': _('Log in'),
})
Expand All @@ -48,11 +43,10 @@ def form_valid(self, form):
return self.form_invalid(form)

def form_invalid(self, form):
ip_address, is_routable = get_client_ip(self.request)
instance = LoginAttempt.objects.create(
username=self.request.POST.get('username'),
session_key=self.request.session.session_key,
ip_address=ip_address,
ip_address=self.request.META.get('REMOTE_ADDR'),
user_agent=self.request.META.get('HTTP_USER_AGENT'),
path=self.request.get_full_path(),
)
Expand Down