From 142beff183885b74728cebc29cf3b916d84ea009 Mon Sep 17 00:00:00 2001 From: kououken Date: Fri, 15 Feb 2019 14:21:48 -0800 Subject: [PATCH 1/5] Implemented owner-checking and Unauthorized error messages. --- back/backend/views.py | 30 +++++++++++++++++++++++++++++- back/db.sqlite3 | Bin 105472 -> 105472 bytes 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/back/backend/views.py b/back/backend/views.py index 6de2b1e..75eb23e 100644 --- a/back/backend/views.py +++ b/back/backend/views.py @@ -84,6 +84,10 @@ def get_fields(s_id): def generate_named_fields_for_section(fields): + ''' + Converts a section's field data into key-value pairs + for use in policy rule lambda functions. + ''' result = {} for field in fields: key = field['field_name'] @@ -144,10 +148,22 @@ def reports(request): return JsonResponse(report_set) +def user_owns_report(user, report): + ''' + Returns true if the specified user is owner of the report + ''' + report_to_check = Report.objects.filter(id=report) + if len(report_to_check) < 1: + return False + return report_to_check[0].user_id == user # actions for an individual report @api_view(['GET', 'PUT', 'DELETE']) def report_detail(request, report_pk): + # Check that the user owns the report + if not user_owns_report(user=request.user, report=report_pk): + return JsonResponse({"message": "Current user does not own the specified report."}, status=401) + # view the report if request.method == 'GET': data = get_reports(report_pk) @@ -175,10 +191,22 @@ def report_detail(request, report_pk): r.delete() return JsonResponse({"message": "Deleted report: {0}.".format(title)}) +def user_owns_section(user, section): + ''' + Returns true if the specified user is owner of the section + ''' + section_to_check = Section.objects.filter(id=section) + if len(section_to_check) < 1: + return False + report_to_check = section_to_check[0].report_id + return report_to_check.user_id == user # update a section with new data @api_view(['PUT']) def section(request, report_pk, section_pk): + # Check that the user owns the report + if not user_owns_section(user=request.user, section=section_pk): + return JsonResponse({"message": "Current user does not own the specified section."}, status=401) for key in request.data: # get the matching field object @@ -292,4 +320,4 @@ def section_complete(section_pk): return True # return false if no field is filled - return False \ No newline at end of file + return False diff --git a/back/db.sqlite3 b/back/db.sqlite3 index e74167e1ff0b568b03610b45df5cec5bd420eaa7..fe6298f019a4540a7bb612ba62fddf96bc0987a8 100644 GIT binary patch delta 2062 zcmcIlUu;uV7(eHJU3WX!Wq&BRb?Z9D91WD+-mUAuWrl2^b8ch^(!ylBw0CRQt}XZ8 zuG<)HBT9%PIJlZ38Z<_c1WhzG9X^POAwKv(P(&dyJn*6~!xy88OT=^Ux^94pzL?za zmwUeR-S2nK?|kRG(^vG43W8SiLV9h&4ArTj4ld^kF`#$&_mFFi0!$LGT1-B7m%An2=9Oh#~ z@qQ^R3xu;0^GP|>pAf{6uq2VB%^NqEpuDUK8mMJDEdiR&{Jh4rxu_fg9!B7&-pj0I z3n?AR@tU%cn^nrWp)$L}!f_sZlgHuQ&bF{D=TJ^@ZHm7sw2sW!Jr1|W&TY55I4*Oe zsksl#(4`d4nQJb>yKo*}htqHpj>9C3LIQ>%2#3H2dq@mB_e7>|?pKP}1E#!ax&Sct zPHFg(ik@Q{PO9iWs^Nr&;~I{s=t^lgs$o(?Swl%fQAOvG%twk(r>EdPf5i zK8+U8tWx>@5&eLt2+_21=HfxdG-GzFgWBWO7}M#<2%a&^p|E6$hGUV|M!v1JG0{eu zT3iMaRJYrJX$4={R$xVuHv=EuFE!xG8h@gKDaj@b-C%;RK?fgFNt6 zX6>b8fLoPUFS{JArb1+GqH)tMk&i_hB+F6-a;)8LV>uhC1=i(ZS@KXTzRVw&H_|24 zXGFSZs5>xE{RL;?Y{pJMM=8VE9*aBWii_i;k%Yr81!9LqDaNyb;c;=)ITjylPP#L< zvsH9OlZ~~nsx+sgrP;a83_GxL=vHN>;mbScN>)jC02bl*bcqie|D*CEsAqj(ihwnd z?IVIVP*GHZdJ*M;TT~_f9)F0Fm_-lJb#wuxP%pd*eqg8@kPwL2!ZAybmj%__ zft;sb9Z`+r41=62?1pq{5*w#-%x;myG>$RInont^mr}-)@}oJ4OH10GV$f6h58U|q zfG7wtDHNA2@j=TVFA5e(;Ke{_FdP+J>X@`Bb=)uIBBOD+fE|5^7Iz2M&L|2p_kBr5L!y8Nz zWy!^*I;R*ES;donAmSFISJl1kB?j$VnWEDR3B0)?w+OF#+MZ*}*-7Q3@A`0!H%H)E zCa{VOs>`269lb{&60TH(OVq}ie%TPlx(c#*1DZu}6;4nK548|G{eQQRI?6!k5&21w z)=^q@1s)Ty^f3XmGS<<03|$Di$TvHnc!u+;t*!car`p>1IDVu2vDT(DWv6kAZr{K4 zkDmRV6W!d-RQLWDLfsv~a1Ynp>>uvsdiM4@{1ZD;-JHL0s?fSCqvQaT( zqL_dQV<(|RH?}BY7$HP!HvFLQO=DuBMg@!^f*<4yd@_C@pq|^ux~>j#^Z(y_&-uUq zzw^KM`1QQw*Yl<-i%tLlhEkM&c83w3__Y5^A(}=%#-%icR9}D!IN)%OaDG=`m~%$l z0e@d#!0R$>EJn)Zoe&ocgd!EVy`cH-617 zjILne)YfVNdgc{3O$m{MTZbUjxp>Yx(E~8f3=o$eG7iFLn0~^~Y5NGD()JR5O4EgY z0Tzv&@O>H^;d|6a2!Bc4Nw`7v8sS>iVZv)wR>HTdI^tLG5kVeAj{tfU&p-bV)f7?^ zVk(c?oKJ4+(0za&qrcE2^ng4bNL)9mv3S+YWrT0eY{mEIwv_+@0O%`pl6pv;hIe-f zOBD+Et}%A62Uh35*nG&`WHn2zP5ANkTlkGGDc%{oSTtE{$OkmN<*fz?MYw;?MU3sq ztD7w1U!Pv+EG*IU`?9wZ3nQ~~yk)_kN6XtqWdG~}n@86;X!3Yt)_5)m1tsg?-4!9A zOUVmYTzoygo9=*1cYRP!6`+#^(4`kl{y;gn#Qy;wz;vnsYeg8?H`r)Qbst*8m&-k&StiW_&%PtVt2R=}_Zw;0Gol{76Z zDx#r8W(`CfUTJe69C2|@x6k3-eN2(REBMhZy_2lH5)^}2a1i##AIz7b#cl{`IY}bB z57Z3hqH5tocnOZeGVlX<8#8qOdS3T1tQ66*geNNYa0=GQQeIds)1cC_Dy`AL`vKpW z17ctn5o!GEd~*R!0!*q2WB*P=O{{GQ3J#)b&4_#F8e(TAU@tzlKvRM;{AA`jzII`c(4b4`;-|Ar zRSEmQc1lP>1JkoTunZrVxl%BxWY(~{`P>vVPDp4P@a0v?OkB_rij0Ohsf*NxC!H(3 z)W^SOs;6^_ft*gO%4LT*qUX=(g%a9~42nV9vZzAV8kRfDnyS4SGEqX9&x9)e_tahKJ#T>=IUzOmw zpG0+LZJX~PYi}_#c8`r|^R;U2rlzQcwT;`NLv?mf>ljh-*gSSmo5!ZNd2Bjz$7io? z!t~Xi>hV^;c2_#y+%NBv_Z|4bMx}_1@@_)>KNSB*=pw}bJ@pgnA!H|{B(x*Gq3R^H KwD>+b1^)qH4b1QW From 0f53c69e2d82584ff52390e7bb3f95bfb41c6da1 Mon Sep 17 00:00:00 2001 From: Preston Doman Date: Fri, 15 Feb 2019 20:15:39 -0800 Subject: [PATCH 2/5] Fix input field formatting --- front/static/edit_report.html | 1 + front/static/js/viewHistory.js | 34 ++++++++++++++++++++++++++++++++-- front/static/login.html | 2 +- front/static/new_report.html | 3 ++- front/static/signup.html | 2 +- 5 files changed, 37 insertions(+), 5 deletions(-) diff --git a/front/static/edit_report.html b/front/static/edit_report.html index b252cd5..9cf6b27 100644 --- a/front/static/edit_report.html +++ b/front/static/edit_report.html @@ -8,6 +8,7 @@ + Reimbursinator diff --git a/front/static/js/viewHistory.js b/front/static/js/viewHistory.js index 8f0747c..45407a3 100644 --- a/front/static/js/viewHistory.js +++ b/front/static/js/viewHistory.js @@ -97,6 +97,18 @@ function createFormGroup(sectionIdStr, field) { formGroup.appendChild(div); break; case "date": + input.type = "date"; + input.placeholder = "mm-dd-yyyy"; + if (field.value === "None") { + input.value = ""; + } else { + input.value = field.value; + } + input.classList.add("form-control"); + formGroup.appendChild(label); + div.appendChild(input) + formGroup.appendChild(div); + break; case "string": input.type = "text"; input.value = field.value; @@ -107,7 +119,11 @@ function createFormGroup(sectionIdStr, field) { break; case "decimal": input.type = "text"; - input.value = field.value; + if (field.value === "0.00") { + input.value = ""; + } else { + input.value = field.value; + } input.classList.add("form-control"); input.pattern = "\\d+(\\.\\d{2})?"; formGroup.appendChild(label); @@ -116,7 +132,11 @@ function createFormGroup(sectionIdStr, field) { break; case "integer": input.type = "number"; - input.value = field.value; + if (field.value === 0) { + input.value = ""; + } else { + input.value = field.value; + } input.classList.add("form-control"); input.step = 1; input.min = 0; @@ -430,6 +450,16 @@ if (newReportForm) { }); } +document.addEventListener("input", function(event) { + if (event.target.type === "date") { + if (!moment(event.target.value, "YYYY-MM-DD", true).isValid()) { + event.target.setCustomValidity("Invalid date format"); + } else { + event.target.setCustomValidity(""); + } + } +}); + document.addEventListener("submit", function(event) { if (event.target.classList.contains("section-form")) { event.preventDefault(); diff --git a/front/static/login.html b/front/static/login.html index a09051e..5e7b130 100644 --- a/front/static/login.html +++ b/front/static/login.html @@ -25,7 +25,7 @@
- +
diff --git a/front/static/new_report.html b/front/static/new_report.html index daf4c54..dc9ca28 100644 --- a/front/static/new_report.html +++ b/front/static/new_report.html @@ -8,6 +8,7 @@ + Reimbursinator @@ -47,7 +48,7 @@
- +
diff --git a/front/static/signup.html b/front/static/signup.html index 12b1119..ac2668c 100644 --- a/front/static/signup.html +++ b/front/static/signup.html @@ -25,7 +25,7 @@