From: Radek Czajka <rczajka@rczajka.pl>
Date: Thu, 12 Oct 2023 08:19:53 +0000 (+0200)
Subject: Reject interrupted requests.
X-Git-Url: https://git.mdrn.pl/redakcja.git/commitdiff_plain/4628276e4a8f159cded83f8dbf7ec8239705f84a?ds=inline

Reject interrupted requests.
---

diff --git a/src/redakcja/static/js/wiki/base.js b/src/redakcja/static/js/wiki/base.js
index 1b031cad..ad0ca835 100644
--- a/src/redakcja/static/js/wiki/base.js
+++ b/src/redakcja/static/js/wiki/base.js
@@ -308,7 +308,7 @@
                 var span = $("*[data-ui-error-for='"+field_name+"']", this.$elem);
 
                 if(!span.length) {
-                    unassigned.push(field_name);
+                    unassigned.push(errors[field_name]);
                     continue;
                 }
 
@@ -316,7 +316,8 @@
             }
 
             if(unassigned.length > 0)
-                global.text( global.text() + 'W formularzu wystąpiły błędy');
+                global.text(
+                    global.text() + 'Wystąpił błąd: ' + unassigned.join(', '));
         }
     }
 
diff --git a/src/wiki/locale/pl/LC_MESSAGES/django.mo b/src/wiki/locale/pl/LC_MESSAGES/django.mo
index 4ac25752..084d16c8 100644
Binary files a/src/wiki/locale/pl/LC_MESSAGES/django.mo and b/src/wiki/locale/pl/LC_MESSAGES/django.mo differ
diff --git a/src/wiki/locale/pl/LC_MESSAGES/django.po b/src/wiki/locale/pl/LC_MESSAGES/django.po
index 0866257c..352c3db8 100644
--- a/src/wiki/locale/pl/LC_MESSAGES/django.po
+++ b/src/wiki/locale/pl/LC_MESSAGES/django.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Platforma Redakcyjna\n"
 "Report-Msgid-Bugs-To: \n"
-"PO-Revision-Date: 2023-10-10 15:18+0200\n"
+"PO-Revision-Date: 2023-10-12 10:12+0200\n"
 "Last-Translator: Radek Czajka <radoslaw.czajka@nowoczesnapolska.org.pl>\n"
 "Language-Team: Fundacja Nowoczesna Polska <fundacja@nowoczesnapolska.org."
 "pl>\n"
@@ -275,15 +275,24 @@ msgstr "Wstaw referencję"
 msgid "Visual editor"
 msgstr "Edytor wizualny"
 
-#: wiki/views.py:326
+#: wiki/views.py:138
+msgid "Wrong content length, request probably interrupted."
+msgstr ""
+"Nieprawidłowa długość treści, żądanie prawdopodobnie zostało przerwane."
+
+#: wiki/views.py:146
+msgid "Content length required."
+msgstr "Brak nagłówka określającego długość treści zapytania."
+
+#: wiki/views.py:347
 msgid "Published"
 msgstr "Opublikowano"
 
-#: wiki/views.py:347
+#: wiki/views.py:368
 msgid "Revision marked"
 msgstr "Wersja oznaczona"
 
-#: wiki/views.py:349
+#: wiki/views.py:370
 msgid "Nothing changed"
 msgstr "Nic nie uległo zmianie"
 
diff --git a/src/wiki/views.py b/src/wiki/views.py
index aea44390..e22c0286 100644
--- a/src/wiki/views.py
+++ b/src/wiki/views.py
@@ -2,6 +2,7 @@
 # Copyright © Fundacja Nowoczesna Polska. See NOTICE for more information.
 #
 from datetime import datetime
+import json
 import os
 import logging
 from time import mktime
@@ -11,7 +12,7 @@ from django.apps import apps
 from django.conf import settings
 from django.urls import reverse
 from django import http
-from django.http import Http404, HttpResponseForbidden
+from django.http import Http404, HttpResponse, HttpResponseForbidden, HttpResponseBadRequest
 from django.middleware.gzip import GZipMiddleware
 from django.utils.decorators import decorator_from_middleware
 from django.utils.formats import localize
@@ -38,6 +39,10 @@ logger = logging.getLogger("fnp.wiki")
 MAX_LAST_DOCS = 10
 
 
+class HttpResponseLengthRequired(HttpResponse):
+    status_code = 411
+
+
 @never_cache
 def editor(request, slug, chunk=None, template_name='wiki/document_details.html'):
     try:
@@ -129,6 +134,20 @@ def text(request, chunk_id):
         return HttpResponseForbidden("Not authorized.")
 
     if request.method == 'POST':
+        # Check length to reject broken request.
+        try:
+            expected_cl = int(request.META['CONTENT_LENGTH'])
+        except:
+            return HttpResponseLengthRequired(json.dumps(
+                {"__message": _("Content length required.")}
+            ))
+        # 411 if missing
+        cl = len(request.body)
+        if cl != expected_cl:
+            return HttpResponseBadRequest(json.dumps(
+                {"__message": _("Wrong content length, request probably interrupted.")}
+            ))
+
         form = forms.DocumentTextSaveForm(request.POST, user=request.user, prefix="textsave")
         if form.is_valid():
             if request.user.is_authenticated: