fix/add initial backend view and url route DO NOT MERGE #3421
Conversation
JamesPRobinson
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| response = JsonResponse({"message": f"campaign {id_campaign} expired"}) | ||
| else: | ||
| action = request.POST.get("action") | ||
| response.set_cookie(f"{id_campaign}_{action}", "true", expires=date_expiry) |
Check warning
Code scanning / CodeQL
Failure to use secure cookies Medium
| response = JsonResponse({"message": f"campaign {id_campaign} expired"}) | ||
| else: | ||
| action = request.POST.get("action") | ||
| response.set_cookie(f"{id_campaign}_{action}", "true", expires=date_expiry) |
Check warning
Code scanning / CodeQL
Construction of a cookie using user-supplied input Medium
There was a problem hiding this comment.
I would have some checks here to make sure they fall within a range of accepted values
| @@ -174,9 +174,31 @@ def _get_tags_as_dict(): | |||
| return tags_dict | |||
|
|
|||
|
|
|||
| def show_survey_banner(request): | |||
There was a problem hiding this comment.
Unfortunately would need to delete this code after survey expiry is over
|
|
||
|
|
||
| class SetNotificationCookie(View): | ||
| def post(self, request, *args, **kwargs): |
There was a problem hiding this comment.
I've tried to make this generic but maybe would need to hardcode to survey campaign to avoid the security issues flagged below
There was a problem hiding this comment.
Could you then set a base class and extend from it? Or perhaps a util function can be used here?
Description of change
Rough outline of how we could use the accepted/dimissed cookie. We could call the backend with js* or turn the survey into a django form.