Skip to content

🚧 [feat] ComplĂ©ter les profils utilisateur incomplets#1386

Draft
Jeremy-Bojko wants to merge 12 commits intodevelopfrom
feat/1365-user-profile-completion
Draft

🚧 [feat] ComplĂ©ter les profils utilisateur incomplets#1386
Jeremy-Bojko wants to merge 12 commits intodevelopfrom
feat/1365-user-profile-completion

Conversation

@Jeremy-Bojko
Copy link
Collaborator

@Jeremy-Bojko Jeremy-Bojko commented Jul 3, 2025 •
edited by alice-telescoop
Loading

Il s'agit de :

  • Une correction de bug
  • Une nouvelle fonctionnalitĂ© programmĂ©e
  • Une nouvelle fonctionnalitĂ© spontanĂ©e

DĂ©crivez vos changements

Travaux effectués avec Alice Andres

Checklist d'acceptation de revue de code

  • Aucun texte ne fait rĂ©fĂ©rence Ă  du vocabulaire spĂ©cifique d'un mĂ©tier
  • Mon code est auto-documentĂ© ou la documentation a Ă©tĂ© mise Ă  jour/crĂ©Ă©e
  • La gestion du multi-portail a Ă©tĂ© prise en compte
  • L'accessibilitĂ© a Ă©tĂ© prise en compte
  • Pre-commit est configurĂ© et a Ă©tĂ© lancĂ©
  • Des tests couvrant le code changĂ© ont Ă©tĂ© ajoutĂ©s/modifiĂ©s
  • L'ensemble des tests front et back sont au vert

Demandes

  • Je souhaite un dĂ©ploiement en prĂ©production

resolves #1365

glibersat and others added 4 commits July 2, 2025 16:21
@glibersat
feat(home): add and initialize needs_profile_update
4687f23
@glibersat
Incomplete Profile Handling
ac47ffb 
 - Add view and path so one can complete her profile
 - Make middleware redirect to complete page when detecting an incomplete profile
/!\ Needs testing
@Jeremy-Bojko @alice-telescoop
[feat] update profile user if missing info
f67102d 
Co-authored-by: alice-telescoop <alice-telescoop@users.noreply.github.com>
@Jeremy-Bojko
[style] form complete profile info
39ad692
@Jeremy-Bojko Jeremy-Bojko self-assigned this Jul 3, 2025
github-advanced-security[bot]
github-advanced-security bot found potential problems Jul 3, 2025
View reviewed changes
recoco/apps/home/views.py
if not next_page:
next_page = reverse("home")

return redirect(next_page)

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a
user-provided value
Loading
.

Copilot Autofix

AI 8 months ago

To fix the issue, we need to validate the next_page variable before using it in the redirect function. The Django utility function url_has_allowed_host_and_scheme is well-suited for this purpose. It checks whether a URL is safe to redirect to by verifying that the host and scheme are allowed. If the next_page value fails validation, the code should default to redirecting to a safe fallback URL, such as the home page.

Steps to implement the fix:

  1. Import the url_has_allowed_host_and_scheme function from django.utils.http.
  2. Validate the next_page variable using url_has_allowed_host_and_scheme.
  3. If next_page is invalid, set it to a safe fallback URL (e.g., reverse("home")).
  4. Use the validated next_page in the redirect function.
Suggested changeset 1
recoco/apps/home/views.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/recoco/apps/home/views.py b/recoco/apps/home/views.py
--- a/recoco/apps/home/views.py
+++ b/recoco/apps/home/views.py
@@ -448,3 +448,3 @@
             next_page = request.GET.get("next", None)
-            if not next_page:
+            if not url_has_allowed_host_and_scheme(next_page, allowed_hosts=None):
                 next_page = reverse("home")
EOF
@@ -448,3 +448,3 @@
next_page = request.GET.get("next", None)
if not next_page:
if not url_has_allowed_host_and_scheme(next_page, allowed_hosts=None):
next_page = reverse("home")
Copilot is powered by AI and may make mistakes. Always verify output.
@glibersat glibersat committed this autofix suggestion 8 months ago.
@glibersat @github-advanced-security
Potential fix for code scanning alert no. 65: URL redirection from re

2f235cc 

mote source

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@alice-telescoop
Copy link
Collaborator

alice-telescoop commented Aug 8, 2025 •
edited
Loading

Il manque (cochĂ© quand c'est fait en local mais je pas encore push 😱)

  • ne pas rediriger les utilisateurs non connectĂ©s
  • ne pas rediriger en boucle les appels en xhr (piste)
  • envoyer les champs qu'il faut pour sĂ©lectionner l'organisation (org_name comme pour l'onboarding ?)
  • tests de view
    • pour s'assurer de ne pas accepter de valeurs vides
    • pour flag correctement quand c'est bon

@alice-telescoop
Copy link
Collaborator

alice-telescoop commented Aug 28, 2025

Comme l'indique le dernier commit, mĂȘme si j'ai reportĂ© le changement de nom du champ pour l'organisation, il faut mettre le champ dynamique comme sur l'onboarding @Jeremy-Bojko

@alice-telescoop
Copy link
Collaborator

alice-telescoop commented Sep 15, 2025

On veut faire une modale : context_processor pour envoyer une variable pour que le front active la modale. Le formulaire devrait ĂȘtre intĂ©grĂ© avec HTMX

1 similar comment
@alice-telescoop
Copy link
Collaborator

alice-telescoop commented Sep 16, 2025

On veut faire une modale : context_processor pour envoyer une variable pour que le front active la modale. Le formulaire devrait ĂȘtre intĂ©grĂ© avec HTMX

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@Jeremy-Bojko Jeremy-Bojko

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Avoir des comptes utilisateurs complets

3 participants

@Jeremy-Bojko @alice-telescoop @glibersat