Do not leak admin urls

CHANGELOG.rst

@@ -1,24 +1,45 @@
 CHANGELOG
 =========
 
+1.1.6 (unreleased)
+------------------
+
+* TODO
+
+
+1.1.5 (2019-07-08)
+------------------
+
+* Fix missing 'on_delete' in migrations
+* Fix import of 'six'
+
+
+1.1.4 (2019-04-29)
+------------------
+
+* Fix unicode error in python 3
+* Fix for 'query' field not used in model for Django 1.11
+* Fix leaking the admin url when accessed without login
+* Add 'on_delete=models.CASCADE' required for Django 2.0
+
 
 1.1.3 (2016-10-11)
 ------------------
 
-* fix unicode error in location plugin
-* fix error introduced in 1.1.2 (commit f76dedd7)
+* Fix unicode error in location plugin
+* Fix error introduced in 1.1.2 (commit f76dedd7)
 
 
 1.1.2 (2016-10-11)
 ------------------
 
-* path location plugin: fix absolute url
+* Path location plugin: fix absolute url
 
 
 1.1.1 (2016-09-14)
 ------------------
 
-* fix staticmap with new kml location plugin
+* Fix staticmap with new kml location plugin
 
 
 1.1.0 (2016-09-14)

aldryn_locations/__init__.py

@@ -1 +1 @@
-__version__ = '1.1.3'
+__version__ = '1.1.5'

aldryn_locations/cms_plugins.py

@@ -1,7 +1,7 @@
 import json
 
 from django.utils.translation import ugettext_lazy as _
-from django.core.urlresolvers import reverse
+from django.urls import reverse
 
 from cms.plugin_base import CMSPluginBase
 from cms.plugin_pool import plugin_pool
@@ -56,6 +56,12 @@ def render(self, context, instance, placeholder):
                     data = '{}{}'.format(base_url, data)
                 path_sources.append(data)
             else:
+                if not request.toolbar or not (
+                    getattr(request.toolbar, 'edit_mode')
+                    or getattr(request.toolbar, 'edit_mode_active')
+                ):
+                    # do not leak /admin urls
+                    data['admin'] = None
                 location_data.append(data)
 
         # Options for the map comes from plugin so I assigned it here

aldryn_locations/forms.py

@@ -66,7 +66,6 @@ class EmbedViewPluginForm(ModelForm):
     class Meta:
         model = EmbedViewPlugin
         fields = [
-            'query',
             'map_type',
             'center',
             'zoom',

aldryn_locations/migrations/0002_bump_max_lengths.py

@@ -14,62 +14,62 @@ class Migration(migrations.Migration):
         migrations.AlterField(
             model_name='embeddirectionsplugin',
             name='height',
-            field=models.CharField(default=b'400px', help_text='Plugin height (in pixels).', max_length=255, verbose_name='height'),
+            field=models.CharField(default='400px', help_text='Plugin height (in pixels).', max_length=255, verbose_name='height'),
         ),
         migrations.AlterField(
             model_name='embeddirectionsplugin',
             name='map_type',
-            field=models.CharField(default=b'roadmap', max_length=255, verbose_name='Map Type', choices=[(b'roadmap', 'Roadmap'), (b'satellite', 'Satellite')]),
+            field=models.CharField(default='roadmap', max_length=255, verbose_name='Map Type', choices=[('roadmap', 'Roadmap'), ('satellite', 'Satellite')]),
         ),
         migrations.AlterField(
             model_name='embeddirectionsplugin',
             name='width',
-            field=models.CharField(default=b'100%', help_text='Plugin width (in pixels or percent).', max_length=255, verbose_name='width'),
+            field=models.CharField(default='100%', help_text='Plugin width (in pixels or percent).', max_length=255, verbose_name='width'),
         ),
         migrations.AlterField(
             model_name='embedplaceplugin',
             name='height',
-            field=models.CharField(default=b'400px', help_text='Plugin height (in pixels).', max_length=255, verbose_name='height'),
+            field=models.CharField(default='400px', help_text='Plugin height (in pixels).', max_length=255, verbose_name='height'),
         ),
         migrations.AlterField(
             model_name='embedplaceplugin',
             name='map_type',
-            field=models.CharField(default=b'roadmap', max_length=255, verbose_name='Map Type', choices=[(b'roadmap', 'Roadmap'), (b'satellite', 'Satellite')]),
+            field=models.CharField(default='roadmap', max_length=255, verbose_name='Map Type', choices=[('roadmap', 'Roadmap'), ('satellite', 'Satellite')]),
         ),
         migrations.AlterField(
             model_name='embedplaceplugin',
             name='width',
-            field=models.CharField(default=b'100%', help_text='Plugin width (in pixels or percent).', max_length=255, verbose_name='width'),
+            field=models.CharField(default='100%', help_text='Plugin width (in pixels or percent).', max_length=255, verbose_name='width'),
         ),
         migrations.AlterField(
             model_name='embedsearchplugin',
             name='height',
-            field=models.CharField(default=b'400px', help_text='Plugin height (in pixels).', max_length=255, verbose_name='height'),
+            field=models.CharField(default='400px', help_text='Plugin height (in pixels).', max_length=255, verbose_name='height'),
         ),
         migrations.AlterField(
             model_name='embedsearchplugin',
             name='map_type',
-            field=models.CharField(default=b'roadmap', max_length=255, verbose_name='Map Type', choices=[(b'roadmap', 'Roadmap'), (b'satellite', 'Satellite')]),
+            field=models.CharField(default='roadmap', max_length=255, verbose_name='Map Type', choices=[('roadmap', 'Roadmap'), ('satellite', 'Satellite')]),
         ),
         migrations.AlterField(
             model_name='embedsearchplugin',
             name='width',
-            field=models.CharField(default=b'100%', help_text='Plugin width (in pixels or percent).', max_length=255, verbose_name='width'),
+            field=models.CharField(default='100%', help_text='Plugin width (in pixels or percent).', max_length=255, verbose_name='width'),
         ),
         migrations.AlterField(
             model_name='embedviewplugin',
             name='height',
-            field=models.CharField(default=b'400px', help_text='Plugin height (in pixels).', max_length=255, verbose_name='height'),
+            field=models.CharField(default='400px', help_text='Plugin height (in pixels).', max_length=255, verbose_name='height'),
         ),
         migrations.AlterField(
             model_name='embedviewplugin',
             name='map_type',
-            field=models.CharField(default=b'roadmap', max_length=255, verbose_name='Map Type', choices=[(b'roadmap', 'Roadmap'), (b'satellite', 'Satellite')]),
+            field=models.CharField(default='roadmap', max_length=255, verbose_name='Map Type', choices=[('roadmap', 'Roadmap'), ('satellite', 'Satellite')]),
         ),
         migrations.AlterField(
             model_name='embedviewplugin',
             name='width',
-            field=models.CharField(default=b'100%', help_text='Plugin width (in pixels or percent).', max_length=255, verbose_name='width'),
+            field=models.CharField(default='100%', help_text='Plugin width (in pixels or percent).', max_length=255, verbose_name='width'),
         ),
         migrations.AlterField(
             model_name='locationplugin',
@@ -89,12 +89,12 @@ class Migration(migrations.Migration):
         migrations.AlterField(
             model_name='mapplugin',
             name='height',
-            field=models.CharField(default=b'400px', help_text='Plugin height (in pixels).', max_length=255, verbose_name='height'),
+            field=models.CharField(default='400px', help_text='Plugin height (in pixels).', max_length=255, verbose_name='height'),
         ),
         migrations.AlterField(
             model_name='mapplugin',
             name='map_type',
-            field=models.CharField(default=b'roadmap', max_length=255, verbose_name='Map Type', choices=[(b'roadmap', 'Roadmap'), (b'satellite', 'Satellite'), (b'hybrid', 'Hybrid'), (b'terrain', 'Terrain')]),
+            field=models.CharField(default='roadmap', max_length=255, verbose_name='Map Type', choices=[('roadmap', 'Roadmap'), ('satellite', 'Satellite'), ('hybrid', 'Hybrid'), ('terrain', 'Terrain')]),
         ),
         migrations.AlterField(
             model_name='mapplugin',
@@ -109,6 +109,6 @@ class Migration(migrations.Migration):
         migrations.AlterField(
             model_name='mapplugin',
             name='width',
-            field=models.CharField(default=b'100%', help_text='Plugin width (in pixels or percent).', max_length=255, verbose_name='width'),
+            field=models.CharField(default='100%', help_text='Plugin width (in pixels or percent).', max_length=255, verbose_name='width'),
         ),
     ]

aldryn_locations/migrations/0003_path file location.py

@@ -2,6 +2,7 @@
 from __future__ import unicode_literals
 
 from django.db import migrations, models
+import django.db.models.deletion
 import filer.fields.file
 
 
@@ -17,8 +18,8 @@ class Migration(migrations.Migration):
         migrations.CreateModel(
             name='PathLocationPlugin',
             fields=[
-                ('cmsplugin_ptr', models.OneToOneField(parent_link=True, related_name='aldryn_locations_pathlocationplugin', auto_created=True, primary_key=True, serialize=False, to='cms.CMSPlugin')),
-                ('path_file', filer.fields.file.FilerFileField(related_name='+', verbose_name='Path File (e.g. KML)', to='filer.File')),
+                ('cmsplugin_ptr', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, parent_link=True, related_name='aldryn_locations_pathlocationplugin', auto_created=True, primary_key=True, serialize=False, to='cms.CMSPlugin')),
+                ('path_file', filer.fields.file.FilerFileField(on_delete=django.db.models.deletion.CASCADE, related_name='+', verbose_name='Path File (e.g. KML)', to='filer.File')),
             ],
             options={
                 'abstract': False,

aldryn_locations/migrations/0004_auto_20160914_1511.py

@@ -2,6 +2,7 @@
 from __future__ import unicode_literals
 
 from django.db import migrations, models
+import django.db.models.deletion
 
 
 class Migration(migrations.Migration):
@@ -14,36 +15,36 @@ class Migration(migrations.Migration):
         migrations.AlterField(
             model_name='embeddirectionsplugin',
             name='cmsplugin_ptr',
-            field=models.OneToOneField(parent_link=True, related_name='aldryn_locations_embeddirectionsplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
+            field=models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, parent_link=True, related_name='aldryn_locations_embeddirectionsplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
         ),
         migrations.AlterField(
             model_name='embedplaceplugin',
             name='cmsplugin_ptr',
-            field=models.OneToOneField(parent_link=True, related_name='aldryn_locations_embedplaceplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
+            field=models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, parent_link=True, related_name='aldryn_locations_embedplaceplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
         ),
         migrations.AlterField(
             model_name='embedsearchplugin',
             name='cmsplugin_ptr',
-            field=models.OneToOneField(parent_link=True, related_name='aldryn_locations_embedsearchplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
+            field=models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, parent_link=True, related_name='aldryn_locations_embedsearchplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
         ),
         migrations.AlterField(
             model_name='embedviewplugin',
             name='cmsplugin_ptr',
-            field=models.OneToOneField(parent_link=True, related_name='aldryn_locations_embedviewplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
+            field=models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, parent_link=True, related_name='aldryn_locations_embedviewplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
         ),
         migrations.AlterField(
             model_name='locationplugin',
             name='cmsplugin_ptr',
-            field=models.OneToOneField(parent_link=True, related_name='aldryn_locations_locationplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
+            field=models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, parent_link=True, related_name='aldryn_locations_locationplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
         ),
         migrations.AlterField(
             model_name='mapplugin',
             name='cmsplugin_ptr',
-            field=models.OneToOneField(parent_link=True, related_name='aldryn_locations_mapplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
+            field=models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, parent_link=True, related_name='aldryn_locations_mapplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
         ),
         migrations.AlterField(
             model_name='pathlocationplugin',
             name='cmsplugin_ptr',
-            field=models.OneToOneField(parent_link=True, related_name='aldryn_locations_pathlocationplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
+            field=models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, parent_link=True, related_name='aldryn_locations_pathlocationplugin', primary_key=True, serialize=False, to='cms.CMSPlugin'),
         ),
     ]

aldryn_locations/migrations/0005_auto_20180507_1427.py

@@ -0,0 +1,23 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11 on 2018-05-07 04:27
+from __future__ import unicode_literals
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('aldryn_locations', '0004_auto_20160914_1511'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='embeddirectionsplugin',
+            name='query',
+        ),
+        migrations.RemoveField(
+            model_name='embedviewplugin',
+            name='query',
+        ),
+    ]

aldryn_locations/migrations/0006_fix_broken_routelocation_plugin.py

@@ -0,0 +1,121 @@
+# Generated by Django 2.2.9 on 2020-06-23 18:56
+import django.db.models.deletion
+from cms import api
+from cms.models import CMSPlugin
+from cms.models import Placeholder
+from django.db import migrations
+from django.db import models
+
+
+def transfer_route_location_plugin_data(apps, schema_editor):
+
+    RouteLocationPluginTemp = apps.get_model('aldryn_locations', 'RouteLocationPluginTemp')
+
+    for temp_plugin in RouteLocationPluginTemp.objects.all():
+        old_plugin = CMSPlugin.objects.get(pk=temp_plugin.pk)
+        placeholder_with_old_plugin = Placeholder.objects.get(pk=old_plugin.placeholder.pk)
+        page_with_old_plugin = placeholder_with_old_plugin.page
+
+        if _is_page_published(page_with_old_plugin):
+            draft_page = page_with_old_plugin.get_draft_object()
+            draft_placeholder = draft_page.placeholders.get(slot=placeholder_with_old_plugin.slot)
+            draft_plugins = draft_placeholder.get_plugins()
+            draft_parent_map_plugins = list(
+                filter(
+                    lambda x: (
+                        x.get_bound_plugin().plugin_type == old_plugin.parent.get_bound_plugin().plugin_type and
+                        x.get_bound_plugin().title == old_plugin.parent.get_bound_plugin().title and
+                        _is_numchild_value_broken(x)
+                    ),
+                    draft_plugins
+                )
+            )
+
+            if draft_parent_map_plugins:
+                # For now we'll take the first available MapPlugin in the placeholder
+                draft_parent_map_plugin = draft_parent_map_plugins[0]
+
+                # Fix the broken numchild field's value
+                draft_parent_map_plugin.numchild = draft_parent_map_plugin.get_children().count()
+                draft_parent_map_plugin.save()
+
+                api.add_plugin(
+                    placeholder=draft_placeholder,
+                    language=temp_plugin.language,
+                    target=draft_parent_map_plugin,
+                    address=temp_plugin.address,
+                    zipcode=temp_plugin.zipcode,
+                    city=temp_plugin.city,
+                    content=temp_plugin.content,
+                    depth=temp_plugin.depth,
+                    plugin_type=temp_plugin.plugin_type,
+                    creation_date=temp_plugin.creation_date,
+                    changed_date=temp_plugin.changed_date,
+                    lat=temp_plugin.lat,
+                    lng=temp_plugin.lng,
+                )
+            else:
+                print(
+                    "Failed to find the needed Map plugin on the Draft version of Page. "
+                    "Most probably it doesn't exist anymore."
+                )
+
+        api.add_plugin(
+            placeholder=placeholder_with_old_plugin,
+            language=temp_plugin.language,
+            target=old_plugin.parent,
+            address=temp_plugin.address,
+            zipcode=temp_plugin.zipcode,
+            city=temp_plugin.city,
+            content=temp_plugin.content,
+            depth=temp_plugin.depth,
+            plugin_type=temp_plugin.plugin_type,
+            creation_date=temp_plugin.creation_date,
+            changed_date=temp_plugin.changed_date,
+            lat=temp_plugin.lat,
+            lng=temp_plugin.lng,
+        )
+
+
+def _is_numchild_value_broken(plugin):
+    # The 'numchild' value of broken plugins is greater than actual count of child plugins
+    return plugin.numchild > plugin.get_children().count()
+
+
+def _is_page_published(page):
+    return not page.publisher_is_draft
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('cms', '0022_auto_20180620_1551'),
+        ('aldryn_locations', '0005_auto_20180507_1427'),
+    ]
+
+    operations = [
+        migrations.RenameModel(
+            old_name='RouteLocationPlugin',
+            new_name='RouteLocationPluginTemp',
+        ),
+        migrations.CreateModel(
+            name='RouteLocationPlugin',
+            fields=[
+                ('cmsplugin_ptr', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, parent_link=True, primary_key=True, related_name='aldryn_locations_routelocationplugin', serialize=False, to='cms.CMSPlugin')),
+                ('address', models.CharField(max_length=255, verbose_name='address')),
+                ('zipcode', models.CharField(max_length=30, verbose_name='zip code')),
+                ('city', models.CharField(max_length=255, verbose_name='city')),
+                ('content', models.CharField(blank=True, help_text='Displayed in a info window above location marker', max_length=255, verbose_name='Content')),
+                ('lat', models.FloatField(blank=True, help_text='Use latitude & longitude to fine tune the map position.', null=True, verbose_name='latitude')),
+                ('lng', models.FloatField(blank=True, null=True, verbose_name='longitude')),
+            ],
+            options={
+                'abstract': False,
+            },
+            bases=('cms.cmsplugin',),
+        ),
+        migrations.RunPython(transfer_route_location_plugin_data),
+        migrations.DeleteModel(
+            name='RouteLocationPluginTemp',
+        ),
+    ]