Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added Feature to recommend Users from profile page #2948

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

tsu-ki
Copy link
Contributor

@tsu-ki tsu-ki commented Nov 18, 2024

Users can recommend other uses directly from their profile page. I've also added a badge which shows the recommended users.
#2632

Screen.Recording.2024-11-19.at.2.08.44.AM.mov

Copy link

sentry-io bot commented Nov 18, 2024

🔍 Existing Issues For Review

Your pull request is modifying functions with the following pre-existing issues:

📄 File: website/views/user.py

Function Unhandled Issue
get_context_data UserProfile.user.RelatedObjectDoesNotExist: UserProfile has no user. ...
Event Count: 270

Did you find this useful? React with a 👍 or 👎

website/views/user.py Fixed Show fixed Hide fixed
@DonnieBLT
Copy link
Collaborator

This looks good can you please also add a text area where the user can add a recommendation blurb and if there is a blurb then show it on the profile on the bottom of the page otherwise, having the number count is good.

Copy link
Collaborator

@DonnieBLT DonnieBLT left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please see the comment for the changes requested and also please make sure the tests are passing

# Remove any potential template tags or code that might have been entered
if blurb:
# Remove any HTML or template tags
blurb = re.sub(r"<[^>]+>", "", blurb)

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
that depends on a
user-provided value
may run slow on strings starting with '<' and with many repetitions of '<'.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

getting a security alert for these

if blurb:
# Remove any HTML or template tags
blurb = re.sub(r"<[^>]+>", "", blurb)
blurb = re.sub(r"{%.*?%}", "", blurb)

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
that depends on a
user-provided value
may run slow on strings starting with '{%' and with many repetitions of '{%'.
# Remove any HTML or template tags
blurb = re.sub(r"<[^>]+>", "", blurb)
blurb = re.sub(r"{%.*?%}", "", blurb)
blurb = re.sub(r"{{.*?}}", "", blurb)

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
that depends on a
user-provided value
may run slow on strings starting with '{{' and with many repetitions of '{{'.


# Add new view for AJAX blurb recommendations
@require_POST

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a
user-provided value
.


@login_required
def ajax_recommend_user(request, username):

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a
user-provided value
.
@tsu-ki
Copy link
Contributor Author

tsu-ki commented Nov 23, 2024

@DonnieBLT Added a recommendation blurb which can be added to a User's Profile from Edit Profile Page.
Also Added a feature using which other users can recommend a user directly by clicking on a "Recommend" button which is visible to other users only(not self), without having to manually recommend a user.
Also added a feature to show the total number of recommendations received. Retained the function to show total number of recommended users.
#2632

Screen.Recording.2024-11-23.at.4.53.53.PM.mov

Copy link
Collaborator

@DonnieBLT DonnieBLT left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please see comments

- id: fix-encoding-pragma
args:
- --remove
language_version: python3.11
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need all of these

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sure, i'll remove them

@@ -625,6 +628,9 @@
path("time-logs/", TimeLogListView, name="time_logs"),
path("sizzle-daily-log/", sizzle_daily_log, name="sizzle_daily_log"),
path("blog/", include("blog.urls")),
path("recommend/<int:user_id>/", recommend_user, name="recommend_user"),
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you be consistent and use either user id or username - and do we need 3 more urls? Can we do this all with one more?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

each of the 3 urls determine, recommend users manually(using the dedicated recommendation feature on user profile) , recommend directly from the button under the recommendation blurb and another is ajax recommendation(this was optional and can be removed)

# Remove any potential template tags or code that might have been entered
if blurb:
# Remove any HTML or template tags
blurb = re.sub(r"<[^>]+>", "", blurb)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

getting a security alert for these

Copy link
Collaborator

@DonnieBLT DonnieBLT left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there are a few changes to make also did you ever get permission from @npxpatel to use his code?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is missing imports

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

umm, can you please tell me which imports are missing from this file? I apologise if I missed any

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you can check the original here it has the missing import - https://github.com/OWASP-BLT/BLT/pull/2656/files - did you test this code? This would have thrown an error.

@DonnieBLT
Copy link
Collaborator

code was originally from here #2656

@tsu-ki
Copy link
Contributor Author

tsu-ki commented Nov 24, 2024

there are a few changes to make also did you ever get permission from @npxpatel to use his code?

I did ask him but he never replied

@DonnieBLT
Copy link
Collaborator

You also copied our badge to a new project without retaining the license?
image

@tsu-ki
Copy link
Contributor Author

tsu-ki commented Nov 24, 2024

You also copied our badge to a new project without retaining the license? image

Actually, I created this project solely to develop a badge for BLT repository which can be used in the README.md file(#2940) and never intended on using it anywhere else. I was going to archive the repository and delete the badge as soon as the corresponding PR for the issue was merged, I waited so just in case the badge I created could come in-use.
I apologise if this created a misunderstanding, I'll delete the created badge so as not to cause any more confusion.
If there's anything else I can do, please do let me know, again, I'm sorry.

@tsu-ki tsu-ki mentioned this pull request Nov 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants