Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add shortcut to tip user #5415

Merged
merged 9 commits into from
Dec 13, 2019
Merged

Add shortcut to tip user #5415

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
9e55973
Add shortcut to tip user
Oct 29, 2019
0e40576
Change var for let in loop and let in favor of const
Oct 30, 2019
b17e3d0
Remove python code wrong placed at send2.html
Nov 5, 2019
2617bde
Conditionally include user and username context params
Nov 5, 2019
5bc023d
Remove username to prevent code injection
zoek1 Nov 6, 2019
6557d18
Update send2.html
zoek1 Nov 14, 2019
d1f3cfd
Change search user handle to use iexact
zoek1 Dec 9, 2019
170b560
Add tip button
zoek1 Dec 9, 2019
c82443b
fix merge conflict
zoek1 Dec 9, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion app/app/urls.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,7 @@
url(r'^tip/send/2/?', dashboard.tip_views.send_tip_2, name='send_tip_2'),
url(r'^tip/send/?', dashboard.tip_views.send_tip, name='send_tip'),
url(r'^send/?', dashboard.tip_views.send_tip, name='tip'),
url(r'^tip/?', dashboard.tip_views.send_tip, name='tip'),
url(r'^tip/?', dashboard.tip_views.send_tip_2, name='tip'),

# Legal
re_path(r'^terms/?', dashboard.views.terms, name='_terms'),
Expand Down
14 changes: 13 additions & 1 deletion app/assets/v2/js/user-search.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,8 +92,20 @@ function userSearch(elem, showAddress, theme, initialData, allowClear, suppress_
return selected;
}

function formatUserSelectionWithAddress(user) {
function formatUserSelectionWithAddress(base_user) {
let selected;
let existent_properties = {};

if (base_user.element) {
const attr = base_user.element.attributes;
const attr_length = attr.length;

for (let i = 0; i < attr_length; i++) {
existent_properties[attr[i].nodeName] = attr[i].nodeValue;
}
}

let user = $.extend({}, existent_properties, base_user);

if (user.id) {
selected = `
Expand Down
14 changes: 13 additions & 1 deletion app/dashboard/templates/onepager/send2.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,11 @@ <h1>{% trans "Send Tip." %}</h1>
<div id="tooltip" class="ethinfo-hover">{% trans "Where is my Eth going? " %}<i class='fa fa-info-circle'></i></div><br>
<div class="pb-1 to_name">
<label>{% trans "To Github Username" %}:</label> <br>
<select id="username" class="username-search custom-select" style="max-width: 400px; margin-left: auto; margin-right: auto;"></select>
<select id="username" class="username-search custom-select" style="max-width: 400px; margin-left: auto; margin-right: auto;">
{% if user_json %}
<option value="{{ user_json.id }}" avatar_id="{{ user_json.avatar_id }}" avatar_url="{{ user_json.avatar_url }}" preferred_payout_address="{{ user_json.preferred_payout_address }}">{{ user_json.text }}</option>
{% endif %}
</select>
</div>
<div>
<label>{% trans "From Github Username" %} {% if not request.user.is_authenticated %}(<a href="{% url 'social:begin' 'github' %}?next=/tip" onclick="dataLayer.push({'event': 'login'});">{% trans "Login" %}</a>) {%endif%}</label>
Expand Down Expand Up @@ -164,4 +168,12 @@ <h3>{% trans "with instructions about how to receive their tip." %}</h1>
{% trans "We send the funds directly to the address associated with the user." %}</span>
</div>
</section>

{% if not user_json and username %}
<script>
setTimeout(function() {
alert("Sorry, we can find the user @{{ username }}");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lets remove the username here - I'm not sure exactly how the django template injection prevention would work here, but I worry someone will create a URL with the username "); do_something_bad();

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, no problem. Just by reference https://docs.djangoproject.com/en/2.2/topics/security/#cross-site-scripting-xss-protection

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah - I'm just paranoid :) I trust the Django devs are good and all, but you can never be too careful!

}, 1000);
</script>
{% endif %}
{% endblock %}
22 changes: 22 additions & 0 deletions app/dashboard/tip_views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -367,10 +367,26 @@ def send_tip_2(request):
TemplateResponse: Render the submission form.

"""

username = request.GET.get('username', None)
is_user_authenticated = request.user.is_authenticated
from_username = request.user.username if is_user_authenticated else ''
primary_from_email = request.user.email if is_user_authenticated else ''

user = {}
if username:
profiles = Profile.objects.filter(handle__icontains=username)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we should do an exact match here to prevent similar names matching: i.e. I try to tip user Dan but theres a user named DanBot. Since there's no order_by clause we can't be sure which user will get returned. Better to use iexact here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, i already changed it! 😃


if profiles.exists():
profile = profiles.first()
user['id'] = profile.id
user['text'] = profile.handle

if profile.avatar_baseavatar_related.exists():
user['avatar_id'] = profile.avatar_baseavatar_related.first().pk
user['avatar_url'] = profile.avatar_baseavatar_related.first().avatar_url
user['preferred_payout_address'] = profile.preferred_payout_address

params = {
'issueURL': request.GET.get('source'),
'class': 'send2',
Expand All @@ -380,4 +396,10 @@ def send_tip_2(request):
'title': 'Send Tip | Gitcoin',
'card_desc': 'Send a tip to any github user at the click of a button.',
}

if user:
params['user_json'] = user
else:
params['username'] = username

return TemplateResponse(request, 'onepager/send2.html', params)