inventree/InvenTree
2
0
Fork 0
mirror of https://github.com/inventree/InvenTree.git synced 2025-06-19 05:25:42 +00:00
Code Activity

Add bleach (#41) (#3204)

Browse Source 
* use shims for API view inheritation

* Add mixin for input sanitation

* fix clean operation to fix all string values

* Also clean up dicts
this is to future-proof this function

* Update docstirng

* proof custom methods against XSS through authenticated users
This commit is contained in:
Matthias Mair
2022-06-16 02:01:53 +02:00
committed by GitHub
parent f8a2760955
commit e83995b4f5
12 changed files with 310 additions and 178 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
InvenTree/label/api.py
View File

@ -6,11 +6,12 @@ from django.http import HttpResponse, JsonResponse
from django.urls import include, re_path
from django_filters.rest_framework import DjangoFilterBackend
from rest_framework import filters, generics
from rest_framework import filters
from rest_framework.exceptions import NotFound
import common.models
import InvenTree.helpers
from InvenTree.mixins import ListAPI, RetrieveAPI, RetrieveUpdateDestroyAPI
from InvenTree.tasks import offload_task
from part.models import Part
from plugin.base.label import label as plugin_label
@ -22,7 +23,7 @@ from .serializers import (PartLabelSerializer, StockItemLabelSerializer,
StockLocationLabelSerializer)
class LabelListView(generics.ListAPIView):
class LabelListView(ListAPI):
"""Generic API class for label templates."""
filter_backends = [
@ -275,14 +276,14 @@ class StockItemLabelList(LabelListView, StockItemLabelMixin):
return queryset
class StockItemLabelDetail(generics.RetrieveUpdateDestroyAPIView):
class StockItemLabelDetail(RetrieveUpdateDestroyAPI):
"""API endpoint for a single StockItemLabel object."""
queryset = StockItemLabel.objects.all()
serializer_class = StockItemLabelSerializer
class StockItemLabelPrint(generics.RetrieveAPIView, StockItemLabelMixin, LabelPrintMixin):
class StockItemLabelPrint(RetrieveAPI, StockItemLabelMixin, LabelPrintMixin):
"""API endpoint for printing a StockItemLabel object."""
queryset = StockItemLabel.objects.all()
@ -391,14 +392,14 @@ class StockLocationLabelList(LabelListView, StockLocationLabelMixin):
return queryset
class StockLocationLabelDetail(generics.RetrieveUpdateDestroyAPIView):
class StockLocationLabelDetail(RetrieveUpdateDestroyAPI):
"""API endpoint for a single StockLocationLabel object."""
queryset = StockLocationLabel.objects.all()
serializer_class = StockLocationLabelSerializer
class StockLocationLabelPrint(generics.RetrieveAPIView, StockLocationLabelMixin, LabelPrintMixin):
class StockLocationLabelPrint(RetrieveAPI, StockLocationLabelMixin, LabelPrintMixin):
"""API endpoint for printing a StockLocationLabel object."""
queryset = StockLocationLabel.objects.all()
@ -483,14 +484,14 @@ class PartLabelList(LabelListView, PartLabelMixin):
return queryset
class PartLabelDetail(generics.RetrieveUpdateDestroyAPIView):
class PartLabelDetail(RetrieveUpdateDestroyAPI):
"""API endpoint for a single PartLabel object."""
queryset = PartLabel.objects.all()
serializer_class = PartLabelSerializer
class PartLabelPrint(generics.RetrieveAPIView, PartLabelMixin, LabelPrintMixin):
class PartLabelPrint(RetrieveAPI, PartLabelMixin, LabelPrintMixin):
"""API endpoint for printing a PartLabel object."""
queryset = PartLabel.objects.all()