- core/views.py: fix open redirect in login — validate next_url with
url_has_allowed_host_and_scheme before redirecting
- visit_manager/api/views.py: add explicit permission_classes/
authentication_classes on all 3 API views; add MIME magic-byte
validation + Pillow verify for photo uploads; validate employee_id/
location_id/date query params; restrict photo access to is_staff,
own record, or direct manager
- employees/serializers.py: split into EmployeeSerializer (public
fields only) and EmployeeDetailSerializer (PII fields, for HR/admin)
- mattermost_service.py: sanitize sensitive fields (password, token)
before logging; log only error message not full response body
- settings/base.py: add SESSION/CSRF cookie HttpOnly + SameSite flags;
set file upload size limits (15MB); remove BasicAuthentication from
DRF (sends credentials in plaintext)
- Renamed is_staff label to 'Доступ к панели администратора' with
clearer help text explaining it's for IT admins only
- Removed is_staff from the standard Authentication fieldset
- Added get_fieldsets() override: superusers get an extra collapsed
'Системный доступ' tab with is_staff and user_permissions
- Remove Employee.role CharField — was a display-only label with no
actual permission logic
- 3 migrations: create groups, migrate data, remove field
- Admin: list/filter/fieldset now use groups; added groups_display method
- Serializer: role → groups (SlugRelatedField returning group names)
- Template: get_role_display → groups.first.name
- EmployeePermissionOverride and PermissionGroup remain for fine-grained
per-employee and per-group permission management
- New signal: create MM account via Celery when employee is created
and mattermost_sync_enabled=True
- New signal: deactivate MM account when employee.is_active flips to False
- Fix: photo comparison now uses pre_save cache instead of re-reading
from DB after save (old code always returned early, photo never synced)
lokses