From 8a944ad696b045174764c6cbbacbd5c9788751f3 Mon Sep 17 00:00:00 2001 From: ismail Date: Wed, 17 Jun 2026 20:32:07 +0300 Subject: [PATCH] fix: 3 system-wide bugs found in URL health sweep (242 URLs, 0 errors after fix) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. /config/test/ — json.loads(request.body) on GET crashed with JSONDecodeError. Added @require_http_methods(['POST']) so GET returns 405 instead of 500. 2. /organizations/dropdowns/subsections/ — LegacySubSection.objects.order_by('name') used wrong field name (model has name_en/name_ar, not 'name'). Fixed to 'name_en'. 3. /rca/create/ — RCACreateView.dispatch() called _check_rca_create(request) before LoginRequiredMixin ran, so AnonymousUser hit is_px_admin() → AttributeError. Added auth check before the RBAC check in dispatch(). Post-fix: authenticated sweep of all 242 UI URLs → 233 OK, 0 errors (500s). --- apps/core/config_views.py | 2 ++ apps/organizations/views.py | 2 +- apps/rca/views.py | 2 ++ 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/apps/core/config_views.py b/apps/core/config_views.py index c391618..689e09e 100644 --- a/apps/core/config_views.py +++ b/apps/core/config_views.py @@ -256,6 +256,7 @@ def reset_user_password(request, user_id): from django.views.decorators.csrf import csrf_exempt +from django.views.decorators.http import require_http_methods from rich import print from django.contrib.auth.hashers import check_password as verify_password @@ -292,6 +293,7 @@ def toggle_user_active(request, user_id): @csrf_exempt +@require_http_methods(["POST"]) def test(request): import json from django.http import JsonResponse diff --git a/apps/organizations/views.py b/apps/organizations/views.py index 04e9db6..7e03644 100644 --- a/apps/organizations/views.py +++ b/apps/organizations/views.py @@ -761,7 +761,7 @@ def api_subsection_list(request): - location: Filter by location ID - main_section: Filter by main section ID """ - subsections = LegacySubSection.objects.all().order_by("name") + subsections = LegacySubSection.objects.all().order_by("name_en") location_id = request.GET.get("location") main_section_id = request.GET.get("main_section") diff --git a/apps/rca/views.py b/apps/rca/views.py index 449bcb4..73e5c34 100644 --- a/apps/rca/views.py +++ b/apps/rca/views.py @@ -289,6 +289,8 @@ class RCACreateView(LoginRequiredMixin, CreateView): success_url = reverse_lazy("rca:rca_list") def dispatch(self, request, *args, **kwargs): + if not request.user.is_authenticated: + return self.handle_no_permission() _check_rca_create(request) return super().dispatch(request, *args, **kwargs)