7/8 Security: fix the clinical-PDF exposure, SECRET_KEY from env, config hardening - #641
Open
mcfrank wants to merge 1 commit into
Open
7/8 Security: fix the clinical-PDF exposure, SECRET_KEY from env, config hardening#641mcfrank wants to merge 1 commit into
mcfrank wants to merge 1 commit into
Conversation
…oken login gating The custom LoginRequiredMiddleware was a no-op: LOGIN_EXEMPT_URLS ended with r"^", which matches every path, so nothing was ever gated by it. Access control actually lives on the views — but the audit found three that lacked it, including a real exposure: the researcher clinical-report PDF view (child data) was reachable by guessable study pk with NO authentication. It now requires login and is ownership-scoped (get_queryset filters researcher=request.user); other researchers get 404, anonymous requests redirect to login. ProfileView and the two /interface/ajax/ endpoints also gain LoginRequiredMixin (which turns their previous anonymous 500s into clean redirects). The dead middleware and LOGIN_EXEMPT_URLS are removed, with a note left in settings. Config hardening: SECRET_KEY is read from the environment first (the generated-file fallback stays so existing deploys keep working, but each fresh instance minting its own key invalidates sessions — production should set the env var). The Google Analytics ID moves to GOOGLE_ANALYTICS_ID (empty disables the snippet entirely) and the Amazon gift-card URLs move to settings.AMAZON_GIFT_CARD_URLS. Tests: ajax/PDF view tests now authenticate; new tests assert the PDF view redirects anonymous users and 404s non-owners. Fixes #626, #627. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Continues the stack (targets the jsCat PR's branch; merge after #622). Closes #626, #627 — and effectively #630.
Please prioritize the review of this one. The audit found a real exposure: the researcher clinical-report PDF view (which renders child data) was reachable by guessable study pk with no authentication at all. Everyone assumed the custom
LoginRequiredMiddlewarecovered it, but that middleware was a no-op — itsLOGIN_EXEMPT_URLSended withr"^", which matches every path. Worth checking whether any such PDF URL was ever shared outside the lab.LoginRequiredMixin+ ownership-scoped (get_querysetfiltersresearcher=request.user). New tests assert anonymous → redirect, non-owner → 404.ProfileViewand the two/interface/ajax/endpoints (this also converts their previous anonymous 500s — Anonymous AJAX endpoints 500 on missing params #630 — into clean redirects).LoginRequiredMiddlewareandLOGIN_EXEMPT_URLS, with a note in settings explaining that access control lives on the views (researcher views useLoginRequiredMixin; participant views are anonymous by hash-URL design).SECRET_KEYread from the environment first (generated-file fallback kept; production should set the env var — each fresh instance minting its own key invalidates sessions). GA ID →GOOGLE_ANALYTICS_ID(empty disables the snippet). Amazon gift-card URLs →settings.AMAZON_GIFT_CARD_URLS.Tests: 7 tests that had encoded the insecure behavior (hitting protected endpoints anonymously) now authenticate; targeted download/ajax/PDF suites green (38 tests).
🤖 Generated with Claude Code