Skip to content

Frontend vulnerabilities #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Frontend vulnerabilities #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
39f384d
Merge pull request #18 from dheepak-aot/master
dheepak-aot Mar 31, 2021
e716a04
VUlnerabilites fix for blackout
dheepak-aot Mar 31, 2021
0743707
Revert "pull from AOT Branch"
dheepak-aot Mar 31, 2021
3b0e9ab
Merge pull request #19 from dheepak-aot/revert-18-master
dheepak-aot Mar 31, 2021
8879a1f
Merge branch 'frontend-vulnerabilities' of https://github.com/dheepak…
dheepak-aot Mar 31, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion api/app/admin/csr.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -209,7 +209,7 @@ class CSRConfigGA(CSRConfig):
def check_uservalues(updated_csr):

# Assume data does not need to be updated
update_data = False
update_data = False;

# See if spaces at start or end of user name.
if updated_csr.username != updated_csr.username.strip():
Expand Down
98 changes: 8 additions & 90 deletions api/app/admin/office.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,6 @@
from qsystem import db, cache, socketio
from pprint import pprint
from wtforms import TextAreaField
from app.models.theq import CSR


def on_form_prefill(counters):
Expand Down Expand Up @@ -52,16 +51,10 @@ def get_query(self):
can_delete = False
form_create_rules = ('office_name', 'office_number', 'sb', 'services', 'deleted', 'exams_enabled_ind',
'appointments_enabled_ind', 'timezone', 'latitude', 'longitude', 'office_appointment_message',
'appointments_days_limit', 'appointment_duration', 'soonest_appointment', 'max_person_appointment_per_day',\
'civic_address', 'telephone', 'online_status', 'check_in_notification', 'check_in_reminder_msg',\
'automatic_reminder_at', 'currently_waiting', 'digital_signage_message', 'digital_signage_message_1',\
'digital_signage_message_2', 'digital_signage_message_3', 'show_currently_waiting_bottom' )
'appointments_days_limit', 'appointment_duration', 'soonest_appointment', 'max_person_appointment_per_day', 'civic_address', 'telephone', 'online_status')
form_edit_rules = ('office_name', 'office_number', 'sb', 'services', 'deleted', 'exams_enabled_ind',
'appointments_enabled_ind', 'timezone', 'latitude', 'longitude', 'office_appointment_message',
'appointments_days_limit', 'appointment_duration', 'soonest_appointment', 'max_person_appointment_per_day',\
'civic_address', 'telephone', 'online_status', 'check_in_notification', 'check_in_reminder_msg', \
'automatic_reminder_at', 'currently_waiting', 'digital_signage_message', 'digital_signage_message_1',\
'digital_signage_message_2', 'digital_signage_message_3', 'show_currently_waiting_bottom' )
'appointments_days_limit', 'appointment_duration', 'soonest_appointment', 'max_person_appointment_per_day', 'civic_address', 'telephone', 'online_status')
form_choices = {
'exams_enabled_ind': [
("0", 'No - Exams are not enabled for this office'), \
Expand All @@ -70,29 +63,7 @@ def get_query(self):
'appointments_enabled_ind': [
("0", 'No - Appointments are not enabled for this office'), \
("1", 'Yes - Appointments are enabled for this office')
],
'check_in_notification': [
("0", 'Off - Disabale Notifications'), \
("1", 'On - Enable Notifications')
],
'automatic_reminder_at': [
("0", 'Off - Disable Feature'), \
("1", '1 - First in Line'), \
("2", '2 - Second in Line'),\
("3", '3 - Third in Line')
],
'currently_waiting': [
("0", 'Off - Disabale Currently Waiting in SmartBoard'), \
("1", 'On - Enable Currently Waiting in SmartBoard')
],
'digital_signage_message': [
("0", 'Off - Disabale Messages in SmartBoard'), \
("1", 'On - Enable Messages in SmartBoard')
],
'show_currently_waiting_bottom': [
("0", 'Off - Hide Currently Waiting at bottom in SmartBoard'), \
("1", 'On - Show Currently Waiting from bottom in SmartBoard')
],
]
}
column_labels = {'sb': 'Smartboard', 'timezone.timezone_name': 'Timezone Name'}
column_searchable_list = ('office_name',)
Expand All @@ -115,16 +86,7 @@ def get_query(self):
'timeslots',
'number_of_dlkt',
'office_email_paragraph',
'external_map_link',
'check_in_notification',
'check_in_reminder_msg',
'automatic_reminder_at',
'currently_waiting',
'digital_signage_message',
'digital_signage_message_1',
'digital_signage_message_2',
'digital_signage_message_3',
'show_currently_waiting_bottom',
'external_map_link'
]

form_excluded_columns = ('citizens',
Expand Down Expand Up @@ -158,16 +120,7 @@ def get_query(self):
'timeslots',
'number_of_dlkt',
'office_email_paragraph',
'external_map_link',
'check_in_notification',
'check_in_reminder_msg',
'automatic_reminder_at'
'currently_waiting',
'digital_signage_message',
'digital_signage_message_1',
'digital_signage_message_2',
'digital_signage_message_3',
'show_currently_waiting_bottom',
'external_map_link'
)

form_edit_rules = ('office_name',
Expand All @@ -194,16 +147,7 @@ def get_query(self):
'timeslots',
'number_of_dlkt',
'office_email_paragraph',
'external_map_link',
'check_in_notification',
'check_in_reminder_msg',
'automatic_reminder_at',
'currently_waiting',
'digital_signage_message',
'digital_signage_message_1',
'digital_signage_message_2',
'digital_signage_message_3',
'show_currently_waiting_bottom',
'external_map_link'
)

form_args = {
Expand Down Expand Up @@ -234,16 +178,7 @@ def get_query(self):
'max_person_appointment_per_day': 'Maximum number of appointments allowed for same person per day',
'office_email_paragraph': 'Office Email Paragraph',
'soonest_appointment': 'Soonest Appointment (minutes)',
'appointment_duration': 'Default Appointment Duration',
'check_in_notification': 'Check-In Notifications',
'check_in_reminder_msg': 'Check-In Notification Reminder Message',
'automatic_reminder_at': 'Check-In Notification Automatically Send Message When Ticket is X in Line',
'currently_waiting': 'Currently Waiting in SmartBoard',
'digital_signage_message': 'Digital Signage Message in SmartBoard',
'digital_signage_message_1': 'Digital Signage Message 1',
'digital_signage_message_2': 'Digital Signage Message 2',
'digital_signage_message_3': 'Digital Signage Message 3',
'show_currently_waiting_bottom': 'Show Currently Waiting at Bottom in SmartBoard'
'appointment_duration': 'Default Appointment Duration'
}

column_sortable_list = ['office_name',
Expand Down Expand Up @@ -313,14 +248,6 @@ def get_query(self):
# print(" --> model.counters last line, what is value")
# pprint(model.counters.counter_id)
# pprint(model.counters.counter_name)

def on_model_change(self, form, model, is_created):
csr = CSR.find_by_username(current_user.username)
socketio.emit('clear_csr_cache', { "id": csr.csr_id})
socketio.emit('csr_update',
{"csr_id": csr.csr_id, "receptionist_ind": csr.receptionist_ind},
room=csr.office_id)
socketio.emit('digital_signage_msg_update')


class OfficeConfigGA(OfficeConfig):
Expand Down Expand Up @@ -357,16 +284,7 @@ class OfficeConfigGA(OfficeConfig):
'timeslots',
'number_of_dlkt',
'office_email_paragraph',
'external_map_link',
'check_in_notification',
'check_in_reminder_msg',
'automatic_reminder_at'
'currently_waiting',
'digital_signage_message',
'digital_signage_message_1',
'digital_signage_message_2',
'digital_signage_message_3',
'show_currently_waiting_bottom'
'external_map_link'
)

form_excluded_columns = (
Expand Down
14 changes: 0 additions & 14 deletions api/app/models/theq/citizen.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@

from qsystem import db
from app.models.theq import Base
from sqlalchemy_utc import UtcDateTime, utcnow


class Citizen(Base):
Expand All @@ -40,19 +39,6 @@ class Citizen(Base):
counter = db.relationship('Counter', lazy='joined')
user = db.relationship('PublicUser', lazy='joined')

# for walk-in notification
notification_phone = db.Column(db.String(100), nullable=True)
notification_email = db.Column(db.String(100), nullable=True)
# notification_sent_time = db.Column(UtcDateTime, nullable=True)
notification_sent_time = db.Column(db.DateTime, nullable=True)
reminder_flag = db.Column(db.Integer, nullable=True)
walkin_unique_id = db.Column(db.String(500), nullable=True)
automatic_reminder_flag = db.Column(db.Integer, nullable=True)

# digital signage
created_at = db.Column(UtcDateTime, nullable=True, default=utcnow())


def __repr__(self):
return '<Citizen Name:(name={self.citizen_name!r})>'.format(self=self)

Expand Down
13 changes: 0 additions & 13 deletions api/app/models/theq/office.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,19 +101,6 @@ class Office(Base):
exams = db.relationship("Exam")
rooms = db.relationship('Room')

# for walk-in notifications
check_in_notification = db.Column(db.Integer)
check_in_reminder_msg = db.Column(db.Text)
automatic_reminder_at = db.Column(db.Integer)
# for Digital Signage
currently_waiting = db.Column(db.Integer)
digital_signage_message = db.Column(db.Integer)
digital_signage_message_1 = db.Column(db.Text)
digital_signage_message_2 = db.Column(db.Text)
digital_signage_message_3 = db.Column(db.Text)
show_currently_waiting_bottom = db.Column(db.Integer)


format_string = 'office_%s'
offices_cache_key: str = 'active_offices'

Expand Down
18 changes: 9 additions & 9 deletions api/app/models/theq/service_req.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ def invite(self, csr, invite_type, sr_count = 1):
else:
snowplow_event = "invitefromhold"

active_period.time_end = datetime.utcnow()
active_period.time_end = datetime.now()
# db.session.add(active_period)

period_state_invite = PeriodState.get_state_by_name("Invited")
Expand All @@ -78,7 +78,7 @@ def invite(self, csr, invite_type, sr_count = 1):
csr_id=csr.csr_id,
reception_csr_ind=csr.receptionist_ind,
ps_id=period_state_invite.ps_id,
time_start=datetime.utcnow()
time_start=datetime.now()
)

self.periods.append(new_period)
Expand All @@ -88,7 +88,7 @@ def invite(self, csr, invite_type, sr_count = 1):
def add_to_queue(self, csr, snowplow_event):

active_period = self.get_active_period()
active_period.time_end = datetime.utcnow()
active_period.time_end = datetime.now()
#db.session.add(active_period)

period_state_waiting = PeriodState.get_state_by_name("Waiting")
Expand All @@ -98,7 +98,7 @@ def add_to_queue(self, csr, snowplow_event):
csr_id=csr.csr_id,
reception_csr_ind=csr.receptionist_ind,
ps_id=period_state_waiting.ps_id,
time_start=datetime.utcnow()
time_start=datetime.now()
)
self.periods.append(new_period)

Expand All @@ -114,7 +114,7 @@ def begin_service(self, csr, snowplow_event):
if active_period.ps.ps_name in ["Being Served"]:
raise TypeError("You cannot begin serving a citizen that is already being served")

active_period.time_end = datetime.utcnow()
active_period.time_end = datetime.now()
# db.session.add(active_period)

period_state_being_served = PeriodState.get_state_by_name("Being Served")
Expand All @@ -124,7 +124,7 @@ def begin_service(self, csr, snowplow_event):
csr_id=csr.csr_id,
reception_csr_ind=csr.receptionist_ind,
ps_id=period_state_being_served.ps_id,
time_start=datetime.utcnow()
time_start=datetime.now()
)

self.periods.append(new_period)
Expand All @@ -136,7 +136,7 @@ def begin_service(self, csr, snowplow_event):

def place_on_hold(self, csr):
active_period = self.get_active_period()
active_period.time_end = datetime.utcnow()
active_period.time_end = datetime.now()
# db.session.add(active_period)

period_state_on_hold = PeriodState.get_state_by_name("On hold")
Expand All @@ -146,7 +146,7 @@ def place_on_hold(self, csr):
csr_id=csr.csr_id,
reception_csr_ind=csr.receptionist_ind,
ps_id=period_state_on_hold.ps_id,
time_start=datetime.utcnow()
time_start=datetime.now()
)

self.periods.append(new_period)
Expand All @@ -155,7 +155,7 @@ def place_on_hold(self, csr):

def finish_service(self, csr, clear_comments=True):
active_period = self.get_active_period()
active_period.time_end = datetime.utcnow()
active_period.time_end = datetime.now()
if clear_comments:
self.citizen.citizen_comments = None
# db.session.add(active_period)
2 changes: 1 addition & 1 deletion api/app/resources/bookings/appointment/appointment_post.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ def post(self):
json_data['office_id'] = json_data.get('stat_office_id')

#get start date:
start_time_ct = json_data.get('start_time', False)
start_time_ct = json_data.get('start_time', datetime.now())

# remove below code, once code is tested - new req --> Stop blackouts from cancelling items (offices will call and cancel people individually if we have to close)
is_blackout_appt = json_data.get('blackout_flag', 'N') == 'Y'
Expand Down
Empty file removed api/app/resources/bookings/walkin/__init__.py
View file
Open in desktop
Empty file.
Loading