Merge pull request #101 from vicha-w/sanitise-url

This PR has been tested on dev instance. However, dev instance requires migration of Django databases.

common/static/css/style.css

@@ -7,6 +7,7 @@
   width: 100%;
   z-index: 999;
   backdrop-filter: blur(10px);
+  -webkit-backdrop-filter: blur(10px);
   background-color: rgba(22, 22, 23, .8);
 }
 

data_taking_objects/templates/data_taking_objects/lumisection.html

@@ -30,7 +30,7 @@ <h3>1D histograms</h3>
       <div class="row row-cols-1 row-cols-sm-2 row-cols-md-3 g-3">
         {% for hist in hist1d %}
         <div class="col">
-          <a class="card" href="{% url 'visualize_histogram:visualize_histogram' runnr=runnr lumisection=lumi_number title=hist.title %}">
+          <a class="card" href="{% url 'visualize_histogram:visualize_histogram' runnr=runnr lumisection=lumi_number title_sanitised=hist.title_sanitised %}">
             <div class="card-img-top" id="histogram-id-{{hist.id}}" style="height: 200px;">
               <script>
                   var trace = {
@@ -68,7 +68,7 @@ <h3>2D histograms</h3>
       <div class="row row-cols-1 row-cols-sm-2 row-cols-md-3 g-3">
         {% for hist in hist2d %}
         <div class="col">
-          <a class="card" href="{% url 'visualize_histogram:visualize_histogram' runnr=runnr lumisection=lumi_number title=hist.title %}">
+          <a class="card" href="{% url 'visualize_histogram:visualize_histogram' runnr=runnr lumisection=lumi_number title_sanitised=hist.title_sanitised %}">
             <div class="card-img-top" id="histogram-id-{{hist.id}}" style="height: 200px;">
               <script>
                   var data = [

data_taking_objects/views.py

@@ -1,6 +1,7 @@
 import logging
 
 from django.shortcuts import render, redirect
+from django.contrib.auth.decorators import login_required
 
 from rest_framework import viewsets
 
@@ -12,9 +13,11 @@
 from .forms import DiagnosticForm
 from visualize_histogram.forms import QuickJumpForm
 
-logger = logging.getLogger(__name__)
+from urllib.parse import quote
 
+logger = logging.getLogger(__name__)
 
+@login_required
 def runs_view(request):
     """
     View for histogram file manager. Lists all available datafiles and their
@@ -26,7 +29,7 @@ def runs_view(request):
         if form.is_valid():
             runnr = form.cleaned_data["runnr"]
             lumisection = form.cleaned_data["lumisection"]
-            title = form.cleaned_data["title"]
+            title = quote(form.cleaned_data["title"], safe='')
             return redirect("visualize_histogram:visualize_histogram",
                 runnr=runnr, 
                 lumisection=lumisection, 
@@ -53,7 +56,7 @@ def runs_view(request):
     }
     return render(request, "data_taking_objects/runs.html", context)
 
-
+@login_required
 def run_view(request, run_number):
 
     error_message = None
@@ -84,7 +87,7 @@ def run_view(request, run_number):
         }
         return render(request, "data_taking_objects/run.html", context)
 
-
+@login_required
 def lumisections_view(request):
 
     error_message = None
@@ -104,6 +107,7 @@ def lumisections_view(request):
     return render(request, "data_taking_objects/lumisections.html", context)
 
 
+@login_required
 def lumisection_view(request, run_number, lumi_number):
 
     error_message = None
@@ -147,7 +151,7 @@ def lumisection_view(request, run_number, lumi_number):
 
         return render(request, "data_taking_objects/lumisection.html", context)
 
-
+@login_required
 def diagnostic_view(request):
 
     error_message = None

histograms/models.py

@@ -12,6 +12,7 @@
 from histogram_file_manager.models import HistogramDataFile, HistogramDataFileContents
 
 import histograms.DQMIOReader
+from urllib.parse import quote
 
 logger = logging.getLogger(__name__)
 
@@ -49,6 +50,9 @@ class HistogramBase(models.Model):
         related_name="%(class)s",
     )
 
+    def title_sanitised(self):
+        return quote(self.title, safe='')
+
     class Meta:
         abstract = True
 

histograms/tables.py

@@ -6,6 +6,7 @@
     LumisectionHistogram2D,
 )
 from django.urls import reverse
+from urllib.parse import quote
 
 class RunHistogramTable(tables.Table):
     run = tables.Column(accessor="run.run_number")
@@ -49,7 +50,10 @@ def render(self, record):
         </div>
         </a>
         """, 
-        reverse("visualize_histogram:visualize_histogram", args=(record.lumisection.run_id, record.lumisection.ls_number, record.title)),
+        reverse("visualize_histogram:visualize_histogram", 
+                args=(record.lumisection.run_id, 
+                      record.lumisection.ls_number, 
+                      quote(record.title, safe=''))),
         record.id, record.data, record.id)
 
 class TwoDimensionHistogramColumn(tables.Column):
@@ -78,7 +82,10 @@ def render(self, record):
         </div>
         </a>
         """,
-        reverse("visualize_histogram:visualize_histogram", args=(record.lumisection.run_id, record.lumisection.ls_number, record.title)),
+        reverse("visualize_histogram:visualize_histogram", 
+                args=(record.lumisection.run_id, 
+                      record.lumisection.ls_number, 
+                      quote(record.title, safe=''))),
         record.id, record.data, record.id)
 
 class LumisectionHistogram1DTable(tables.Table):

histograms/views.py

@@ -3,6 +3,7 @@
 
 from django.shortcuts import render
 from django.http import JsonResponse
+from django.contrib.auth.decorators import login_required
 
 from django_tables2 import RequestConfig
 
@@ -27,6 +28,7 @@
 
 # Could be a duplicate of RunHistogramList...
 # Just checking a few things
+@login_required
 def run_histograms_view(request):
 
     error_message = None
@@ -43,6 +45,7 @@ def run_histograms_view(request):
 
 
 # TODO refactor
+@login_required
 def run_histograms_plots_view(request):
 
     error_message = None
@@ -92,6 +95,7 @@ def run_histograms_plots_view(request):
     return render(request, "histograms/run_histograms_plots.html", context)
 
 
+@login_required
 def run_histogram_time_serie_view(request, histogram_name):
 
     error_message = None
@@ -131,6 +135,7 @@ def run_histogram_time_serie_view(request, histogram_name):
     return render(request, "histograms/run_histogram_time_serie.html", context)
 
 
+@login_required
 def altair_chart_view(request):
 
     # chart = {}
@@ -153,6 +158,7 @@ def altair_chart_view(request):
     return JsonResponse(chart_obj, safe=False)
 
 
+@login_required
 def RunHistogramList(request):
     """
     View to list the filtered 1D histograms for Runs
@@ -169,6 +175,7 @@ def RunHistogramList(request):
     return render(request, "histograms/listRunHistos1D.html", context)
 
 
+@login_required
 def LumisectionHistogram1DList(request):
     """
     View to list the filtered 1D histograms for Lumisections
@@ -189,6 +196,7 @@ def LumisectionHistogram1DList(request):
     return render(request, "histograms/listLumisectionHistos1D.html", context)
 
 
+@login_required
 def LumisectionHistogram2DList(request):
     """
     View to list the filtered 2D histograms for Lumisections

mlp/settings.py

@@ -81,6 +81,7 @@
     "django.contrib.auth.middleware.AuthenticationMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
+    "allauth.account.middleware.AccountMiddleware",
 ]
 
 ROOT_URLCONF = "mlp.urls"

visualize_histogram/urls.py

@@ -9,5 +9,5 @@
     path("", data_taking_objects.views.runs_view, name="visualize_histogram_dummy"),
     path("<int:runnr>/", views.redirect_run, name="redirect_run"),
     path("<int:runnr>/<int:lumisection>/", views.redirect_lumisection, name="redirect_lumisection"),
-    path("<int:runnr>/<int:lumisection>/<title>/", views.visualize_histogram, name="visualize_histogram"),
+    path("<int:runnr>/<int:lumisection>/<title_sanitised>/", views.visualize_histogram, name="visualize_histogram"),
 ]

visualize_histogram/views.py

@@ -9,11 +9,12 @@
 import data_taking_objects.views
 
 import numpy as np
+from urllib.parse import quote, unquote
 
 # Create your views here.
 
 @login_required
-def visualize_histogram(request, runnr, lumisection, title):
+def visualize_histogram(request, runnr, lumisection, title_sanitised):
     """
     View for histogram file manager. Lists all available datafiles and their
     parsing status
@@ -25,29 +26,31 @@ def visualize_histogram(request, runnr, lumisection, title):
             runnr = form.cleaned_data["runnr"]
             lumisection = form.cleaned_data["lumisection"]
             title = form.cleaned_data["title"]
+            title_sanitised = quote(title, safe='')
             return redirect("visualize_histogram:visualize_histogram",
                 runnr=runnr, 
                 lumisection=lumisection, 
-                title=title
+                title_sanitised=title_sanitised
             )
         else: 
             form = QuickJumpForm(
                 initial = {
                     "runnr": runnr,
                     "lumisection": lumisection,
-                    "title": title
+                    "title": unquote(title_sanitised)
                 }
             )
     else: 
         form = QuickJumpForm(
             initial = {
                 "runnr": runnr,
                 "lumisection": lumisection,
-                "title": title
+                "title": unquote(title_sanitised)
             }
         )
 
     try:
+        title = unquote(title_sanitised)
         target_lumi = Lumisection.objects.get(run_id = runnr, ls_number = lumisection)
         lumi1d_searchresults = LumisectionHistogram1D.objects.filter(title=title, lumisection=target_lumi)
         lumi2d_searchresults = LumisectionHistogram2D.objects.filter(title=title, lumisection=target_lumi)
@@ -108,11 +111,11 @@ def visualize_histogram_dummy(request):
         if form.is_valid():
             runnr = form.cleaned_data["runnr"]
             lumisection = form.cleaned_data["lumisection"]
-            title = form.cleaned_data["title"]
+            title_sanitised = quote(form.cleaned_data["title"], safe='')
             return redirect("visualize_histogram:visualize_histogram",
                 runnr=runnr, 
                 lumisection=lumisection, 
-                title=title
+                title_sanitised=title_sanitised
             )
         else: form = QuickJumpForm()
     else: