Fix tests latest post

ChangeLog.rst

@@ -25,7 +25,7 @@ Inyoka Changelog
    -----------
 
 
-Unreleased 1.42.1 (2025-01-DD)
+Unreleased 1.42.2 (2025-02-DD)
 ==============================
 
 Deployment notes
@@ -67,6 +67,15 @@ Deployment notes
 * Update requirements (at least the dependencies ``Django`` and ``jinja2`` includes known security fixes)
 
 
+1.42.1 (2025-02-16)
+===================
+
+🔒 Security
+-----------
+
+* Prevent to leak posts via `__service__=forum.get_new_latest_posts`
+
+
 1.42.0 (2024-11-23)
 ===================
 

inyoka/__init__.py

@@ -20,4 +20,4 @@
 from .celery_app import app as celery_app  # noqa
 
 # Inyoka version is updated through bumpversion and can stay hardcoded here.
-INYOKA_VERSION = "1.42.0"
+INYOKA_VERSION = "1.42.1"

inyoka/forum/services.py

@@ -10,6 +10,7 @@
 """
 from urllib.parse import unquote
 
+from django.http import HttpResponseBadRequest
 from django.shortcuts import render
 from django.utils.datastructures import MultiValueDictKeyError
 from django.views.decorators.http import require_GET, require_POST
@@ -164,9 +165,16 @@ def get_version_details(request):
 @require_POST
 @dispatcher.register()
 def get_new_latest_posts(request):
-    post_id = int(request.POST['post'])
+    try:
+        post_id = int(request.POST.get('post'))
+    except (TypeError, ValueError):
+        return HttpResponseBadRequest()
+
     post = Post.objects.get(id=post_id)
 
+    if not request.user.has_perm('forum.view_forum', post.topic.forum) or (not request.user.has_perm('forum.moderate_forum', post.topic.forum) and post.topic.hidden or post.hidden):
+        return None
+
     posts = Post.objects.filter(id__gt=post.id, topic__id=post.topic.id) \
                         .order_by('-position').all()
 

package.json

@@ -1,7 +1,7 @@
 {
   "name": "inyoka",
   "title": "Inyoka theme",
-  "version": "1.42.0",
+  "version": "1.42.1",
   "description": "Inyoka Theme",
   "main": "index.js",
   "scripts": {

pyproject.toml

@@ -116,7 +116,7 @@ ignore = [
 
 
 [tool.bumpversion]
-current_version = "1.42.0"
+current_version = "1.42.1"
 parse = "(?P<major>\\d+)\\.(?P<django>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{django}.{patch}"]
 search = "{current_version}"

tests/apps/forum/test_services.py

@@ -37,9 +37,27 @@ def setUp(self):
                                         topic=self.topic, position=0)
 
         self.client.defaults['HTTP_HOST'] = 'forum.%s' % settings.BASE_DOMAIN_NAME
-        #self.client.login(username='admin', password='admin')
 
     def test_get_new_latest_posts(self):
+        self.client.login(username='admin', password='admin')
+
         response = self.client.post('/?__service__=forum.get_new_latest_posts', data={'post': self.post.id}, follow=True)
         self.assertEqual(response.status_code, 200)
         self.assertContains(response, 'Post 2')
+
+    def test_get_new_latest_posts__anonymous(self):
+        response = self.client.post('/?__service__=forum.get_new_latest_posts', data={'post': self.post.id}, follow=True)
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.content.decode(), 'null')
+
+    def test_get_new_latest_posts__missing_post_parameter(self):
+        response = self.client.post('/?__service__=forum.get_new_latest_posts', follow=True)
+        self.assertEqual(response.status_code, 400)
+
+    def test_get_new_latest_posts__string_as_post_parameter(self):
+        response = self.client.post('/?__service__=forum.get_new_latest_posts', data={'post': 'foo'}, follow=True)
+        self.assertEqual(response.status_code, 400)
+
+    def test_get_new_latest_posts__get_method(self):
+        response = self.client.get('/?__service__=forum.get_new_latest_posts', follow=True)
+        self.assertEqual(response.status_code, 400)