Commit graph

27 commits

Author SHA1 Message Date
Glandos
cc18986b76 add test for multiple join 2022-10-22 23:02:27 +02:00
Glandos
667b65b9cc
Surround email in case of error (#1044)
fix https://huntr.dev/bounties/441cc44c-6837-46ec-9b30-52455aa71a2f/
2022-07-16 23:26:51 +02:00
Glandos
31fef4f4d6
Fix CSRF on logout (#1040)
fix for https://huntr.dev/bounties/a3045614-1125-4901-bb7a-9d51be4beeed/
2022-07-14 15:45:32 +02:00
Glandos
e355894cee
Check for too high values (#989)
* check for too high values

see https://github.com/python-babel/babel/issues/821

fix #957

* black & isort

* add API test
2022-02-02 10:09:49 +01:00
Glandos
07e1eac0a9
Null amount validator was broken (#990) 2022-01-30 16:33:18 +01:00
zorun
c8cbe43ee2
Display monthly statistics for the range of months where the project was active (#885)
* Change the way we import datetime

This makes it easier to use datetime.date later.

* Display monthly statistics for the range of months where the project was active

Currently, we display a hard-coded "one year" range of monthly statistics
starting from today.  This generally is not the intended behaviour: for
instance, on an archived project, the bills might all be older than one
year, so the table only displays months without any operation.

Instead, display all months between the first and last bills.  There might
be empty months in the middle, but that's intended, because we want all
months to be consecutive.

If there are no bills, simply display an empty table.

Co-authored-by: Baptiste Jonglez <git@bitsofnetworks.org>
2022-01-18 14:32:43 +01:00
Youe Graillot
747824a298
CSV bills import (cospend compatible) (#951)
* proper import form (fix messy errors)
* csv compatible import
* cospend compatible import
* localization (best effort)
* refactoring
* revert localization (best effort)
* import return 400 on error
* fix Person.query.get_by_ids calls
* Bill explicit init parameters
* fix tests
* refacto tests with self.get_project
* separate import tests
* fix tests
* csv import test case
* fix import csv parsing
* revert DestructiveActionProjectForm renaming
* fix csv import test
* fix error redirection on import
* fix lint
* import file input type hint
* various fixes from review

Co-authored-by: Youe Graillot <youe.graillot@gmail.com>
2021-12-22 00:00:34 +01:00
ef3944ccad
Send an email when the project is created via the API. (#938) 2021-11-25 00:49:17 +01:00
68552a6034
Allow connecting to upper-case project IDs. (#934)
Fix #933.
2021-11-23 19:09:50 +01:00
beac10be0b
Always authentify projects using a lowercase ID. (#925)
Fixes #920
2021-11-21 17:13:26 +01:00
35a74100cb
Rename all strings to "participants", clean old and small weird stuff (#871)
* Rename all strings to "participants".
* Update the tests with the new strings
* Update tests
2021-11-01 18:25:57 +01:00
Glandos
7d9226745f
Change token path authentication to /PROJECT/join/TOKEN (#843) 2021-10-13 22:00:38 +02:00
zorun
7554842b1f
Add URL validation to external link to prevent XSS (#846)
Co-authored-by: Baptiste Jonglez <git@bitsofnetworks.org>
2021-10-10 18:39:03 +02:00
Glandos
bbe00ebb57
Include project code into project authentication token (#802)
Fix #780 

This a breaking change, the API for authentication is different, as it now requires `project_id`. Token is generated with only the project_id (so it's shorter than before), and signature is done by mixing password with secret key. Thus, it expires on every project code change.
2021-10-10 14:43:40 +02:00
Daniel Neto
60149cd486 Formatting changes after running make black 2021-09-19 19:04:49 +02:00
Daniel Neto
7bf7db24bd #838: Add decima weight round test cases 2021-09-19 19:04:49 +02:00
Baptiste Jonglez
011df29913 Simplify exception checking in import test 2021-09-07 23:15:40 +02:00
Baptiste Jonglez
7ad83c7e79 Add more import test cases related to currencies 2021-09-07 23:15:40 +02:00
Baptiste Jonglez
4bf9308908 Add currency to import and export formats 2021-09-07 23:15:40 +02:00
Baptiste Jonglez
6448d0d7df Move CurrencyConverter mocking to the base test class
This mock was already applied to all tests, because it was done statically
in the TestCurrencyConverter class definition.  But it was really not
clear that it's applied everywhere.

Moving this to the setUp() function makes it much clearer.

Also, remove useless redefinition in other tests.
2021-09-07 23:15:40 +02:00
Baptiste Jonglez
da49012d58 Add test cases to ensure we can't delete objects with a GET 2021-07-17 13:54:11 +02:00
Baptiste Jonglez
95b2cf870b Fix test for project deletion 2021-07-17 13:54:11 +02:00
Baptiste Jonglez
109d7fca17 Add CSRF validation to most disruptive actions
This also switches all such actions to POST requests.

Deleting the project is handled in another commit because it requires more
changes.
2021-07-17 13:54:11 +02:00
Glandos
07b86bc580
Rework currency switching (#661)
Co-authored-by: Alexis Métaireau <alexis@notmyidea.org>

Currency switching is both simpler and less powerful. This was done primarily for users, to have a clear and logical understanding, but the code is also simpler. The main change is that it is now forbidden to switch a project to "no currency" if bills don't share the same currency.

Also, tests assume that projects are created without currency, as in the web UI.
2021-07-06 21:51:32 +02:00
Glandos
27d95f2d01 fix flake8 2021-06-10 00:09:59 +02:00
Glandos
44fa1af375 change method to find login_throttler
that was triggering a lot of deprecation warnings due to
iterating over all known objects.
2021-06-10 00:09:59 +02:00
Miguel Victoria Villaquiran
18068d76ca
Simplify tests (#685)
Fix #501
2021-01-05 22:17:26 +01:00