praekelt / django-atlas

Geolocation models, data and tools using GeoDjango

Praekelt Engineering Ways of Working

These docs are automatically built & available at http://praekelt-prime-directive.rtfd.org/.

Build these docs locally with:

$ virtualenv ve
$ source ve/bin/activate
(ve)$ pip install -r requirements.pip
(ve)$ cd docs
(ve)$ make html

Open index.html in docs/_build/html.

django-atlas's Issues

Django vulnerability

Just a heads-up, your code may be vulnerable to the Django vulnerability CVE-2014-0472 fixed just recently because it seems to allow user-supplied input to reverse() in atlas/views.py:

redirect_to = form.cleaned_data['origin']
if redirect_to != '/':
    redirect_to = reverse(redirect_to)

You should update your Django and/or advise users to do so ASAP. Django security advisory: https://www.djangoproject.com/weblog/2014/apr/21/security/

Found via GitHub code search.

set-location redirect breaks

https://github.com/praekelt/django-atlas/blob/develop/atlas/views.py#L46
origin = getattr(resolve(request.get_full_path()), 'url_name', None)
This breaks for parametrized urls since this call returns the view-name without the parameter. So the following url url(r'^campaigns/(?P<slug>[\w-]+)/$', 'some.view.function', name='campaign_detail'), the value of origin will always be campaing_detail and the subsequent reverse() will fail. https://github.com/praekelt/django-atlas/blob/develop/atlas/views.py#L69

Suggested fix would be to simply use request.get_full_path() and remove the reversing of the url.

Don't use external js library

Take out jQuery ajax call in atlas.js. Use XMLHttpRequest directly.

distance_sphere not always added in MySQL

Issue with south migration for MySQL such that distance_sphere function is not always added