lokses
faa06b9f82
- core/views.py: fix open redirect in login — validate next_url with url_has_allowed_host_and_scheme before redirecting - visit_manager/api/views.py: add explicit permission_classes/ authentication_classes on all 3 API views; add MIME magic-byte validation + Pillow verify for photo uploads; validate employee_id/ location_id/date query params; restrict photo access to is_staff, own record, or direct manager - employees/serializers.py: split into EmployeeSerializer (public fields only) and EmployeeDetailSerializer (PII fields, for HR/admin) - mattermost_service.py: sanitize sensitive fields (password, token) before logging; log only error message not full response body - settings/base.py: add SESSION/CSRF cookie HttpOnly + SameSite flags; set file upload size limits (15MB); remove BasicAuthentication from DRF (sends credentials in plaintext)
32 lines
1.3 KiB
Python
32 lines
1.3 KiB
Python
from rest_framework import serializers
|
|
from apps.employees.models import Employee
|
|
|
|
|
|
class EmployeeSerializer(serializers.ModelSerializer):
|
|
"""Базовый сериализатор — только публичные поля."""
|
|
groups = serializers.SlugRelatedField(many=True, read_only=True, slug_field='name')
|
|
|
|
class Meta:
|
|
model = Employee
|
|
fields = [
|
|
'id', 'username', 'first_name', 'last_name', 'middle_name',
|
|
'email', 'groups', 'photo', 'post', 'department',
|
|
'user_location_type', 'user_organization', 'user_pharmacy',
|
|
'is_active', 'date_joined',
|
|
]
|
|
read_only_fields = ['id', 'date_joined']
|
|
|
|
|
|
class EmployeeDetailSerializer(EmployeeSerializer):
|
|
"""Детальный сериализатор с PII — только для HR/администраторов."""
|
|
|
|
class Meta(EmployeeSerializer.Meta):
|
|
fields = EmployeeSerializer.Meta.fields + [
|
|
'phone', 'personal_phone', 'personal_email',
|
|
'birth_date', 'inn_code',
|
|
'emergency_contact_name', 'emergency_contact_phone', 'emergency_contact_relation',
|
|
'mattermost_username', 'mattermost_sync_enabled',
|
|
'ad_sync_enabled', 'hire_date', 'termination_date',
|
|
'is_staff',
|
|
]
|