diff --git a/CHANGELOG.md b/CHANGELOG.md index 71a1cf03..c2c67538 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ All notable changes to this project will be documented in this file. - API security: check channel ownership when setting check's channels - API: update check's "alert_after" field when changing schedule - API: validate channel identifiers before creating/updating a check (#335) +- Fix redirect after login when adding Telegram integration ## v1.13.0 - 2020-02-13 diff --git a/hc/accounts/views.py b/hc/accounts/views.py index 5f146bec..2b3ffe89 100644 --- a/hc/accounts/views.py +++ b/hc/accounts/views.py @@ -1,4 +1,5 @@ from datetime import timedelta as td +from urllib.parse import urlparse import uuid from django.conf import settings @@ -42,12 +43,17 @@ NEXT_WHITELIST = ( "hc-p-channels", "hc-add-slack", "hc-add-pushover", + "hc-add-telegram", ) -def _is_whitelisted(path): +def _is_whitelisted(redirect_url): + if not redirect_url: + return False + + parsed = urlparse(redirect_url) try: - match = resolve(path) + match = resolve(parsed.path) except Resolver404: return False diff --git a/hc/front/tests/test_add_telegram.py b/hc/front/tests/test_add_telegram.py index 35c1014b..bd299668 100644 --- a/hc/front/tests/test_add_telegram.py +++ b/hc/front/tests/test_add_telegram.py @@ -34,6 +34,13 @@ class AddTelegramTestCase(BaseTestCase): self.assertEqual(c.telegram_name, "My Group") self.assertEqual(c.project, self.project) + def test_it_handles_bad_signature(self): + self.client.login(username="alice@example.org", password="password") + r = self.client.get(self.url + "?bad-signature") + self.assertContains(r, "Incorrect Link") + + self.assertFalse(Channel.objects.exists()) + @patch("hc.api.transports.requests.request") def test_it_sends_invite(self, mock_get): data = { diff --git a/hc/front/urls.py b/hc/front/urls.py index 6cd7e229..4ade6bf9 100644 --- a/hc/front/urls.py +++ b/hc/front/urls.py @@ -30,6 +30,7 @@ channel_urls = [ ), path("add_discord/", views.add_discord_complete, name="hc-add-discord-complete"), path("add_pushover/", views.add_pushover_help), + path("telegram/", views.add_telegram_help), path("telegram/bot/", views.telegram_bot, name="hc-telegram-webhook"), path("add_pdc/", views.add_pdc_help), path("add_slack/", views.add_slack_help), diff --git a/hc/front/views.py b/hc/front/views.py index 23a5640f..e399326b 100644 --- a/hc/front/views.py +++ b/hc/front/views.py @@ -1398,12 +1398,24 @@ def telegram_bot(request): return HttpResponse() +def add_telegram_help(request): + ctx = { + "page": "channels", + "bot_name": settings.TELEGRAM_BOT_NAME, + } + + return render(request, "integrations/add_telegram.html", ctx) + + @login_required def add_telegram(request): chat_id, chat_type, chat_name = None, None, None qs = request.META["QUERY_STRING"] if qs: - chat_id, chat_type, chat_name = signing.loads(qs, max_age=600) + try: + chat_id, chat_type, chat_name = signing.loads(qs, max_age=600) + except signing.BadSignature: + return render(request, "bad_link.html") if request.method == "POST": project = _get_project_for_user(request, request.POST.get("project")) diff --git a/static/img/integrations/setup_telegram_3.png b/static/img/integrations/setup_telegram_3.png index f334d4b9..2523b404 100644 Binary files a/static/img/integrations/setup_telegram_3.png and b/static/img/integrations/setup_telegram_3.png differ diff --git a/templates/integrations/add_slack_btn.html b/templates/integrations/add_slack_btn.html index 67c3c234..aab04424 100644 --- a/templates/integrations/add_slack_btn.html +++ b/templates/integrations/add_slack_btn.html @@ -1,7 +1,7 @@ {% extends "base.html" %} {% load humanize static hc_extras %} -{% block title %}Add Slack - {% site_name %}{% endblock %} +{% block title %}Slack Integration for {% site_name %}{% endblock %} {% block content %}