- core/views.py: fix open redirect in login — validate next_url with
url_has_allowed_host_and_scheme before redirecting
- visit_manager/api/views.py: add explicit permission_classes/
authentication_classes on all 3 API views; add MIME magic-byte
validation + Pillow verify for photo uploads; validate employee_id/
location_id/date query params; restrict photo access to is_staff,
own record, or direct manager
- employees/serializers.py: split into EmployeeSerializer (public
fields only) and EmployeeDetailSerializer (PII fields, for HR/admin)
- mattermost_service.py: sanitize sensitive fields (password, token)
before logging; log only error message not full response body
- settings/base.py: add SESSION/CSRF cookie HttpOnly + SameSite flags;
set file upload size limits (15MB); remove BasicAuthentication from
DRF (sends credentials in plaintext)
- Remove Employee.role CharField — was a display-only label with no
actual permission logic
- 3 migrations: create groups, migrate data, remove field
- Admin: list/filter/fieldset now use groups; added groups_display method
- Serializer: role → groups (SlugRelatedField returning group names)
- Template: get_role_display → groups.first.name
- EmployeePermissionOverride and PermissionGroup remain for fine-grained
per-employee and per-group permission management
lokses