Fix incorrect NGO URLs being used

code4romania · Jan 13, 2025 · 9d76fe9 · 9d76fe9
1 parent cff9a3e
commit 9d76fe9
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/backend/donations/models/ngos.py b/backend/donations/models/ngos.py
@@ -56,6 +56,9 @@ def ngo_slug_validator(value):
     if not value.islower():
         raise ValidationError(error_message)
 
+    if not re.match(r"^[a-z0-9-]+$", value):
+        raise ValidationError(error_message)
+
 
 def ngo_id_number_validator(value):
     reg_num: str = "".join([char for char in value.upper() if char.isalnum()])

diff --git a/backend/donations/views/api.py b/backend/donations/views/api.py
@@ -17,7 +17,7 @@
 from redirectioneaza.common.cache import cache_decorator
 
 from ..models.jobs import Job, JobStatusChoices
-from ..models.ngos import ALL_NGOS_CACHE_KEY, Ngo
+from ..models.ngos import ALL_NGOS_CACHE_KEY, Ngo, ngo_slug_validator
 from ..pdf import create_pdf
 from ..workers.update_organization import update_organization
 from .base import BaseTemplateView
@@ -81,7 +81,10 @@ def validate_ngo_slug(cls, user, slug):
         if not slug or not user and not user.is_staff:
             raise PermissionDenied()
 
-        if slug.lower() in cls.ngo_url_block_list:
+        if user.is_anonymous:
+            raise PermissionDenied()
+
+        if ngo_slug_validator(slug) in cls.ngo_url_block_list:
             return HttpResponseBadRequest()
 
         ngo_queryset = Ngo.objects