mirror of
https://github.com/GSA/notifications-api.git
synced 2025-12-24 01:11:38 -05:00
Ensure that querying for notifications does not return CSV data unless:
- It's explicitly asked for AND - you are using a LIVE key Team and Test keys CANNOT retrieve CSV/Job derived notifications
This commit is contained in:
@@ -21,7 +21,7 @@ from app.models import (
|
||||
NOTIFICATION_CREATED,
|
||||
NOTIFICATION_SENDING,
|
||||
NOTIFICATION_PENDING,
|
||||
NOTIFICATION_TEMPORARY_FAILURE)
|
||||
NOTIFICATION_TEMPORARY_FAILURE, KEY_TYPE_NORMAL)
|
||||
|
||||
from app.dao.dao_utils import transactional
|
||||
from app.statsd_decorators import statsd
|
||||
@@ -232,24 +232,29 @@ def get_notifications_for_service(service_id,
|
||||
page_size=None,
|
||||
limit_days=None,
|
||||
key_type=None,
|
||||
personalisation=False):
|
||||
personalisation=False,
|
||||
include_jobs=False):
|
||||
if page_size is None:
|
||||
page_size = current_app.config['PAGE_SIZE']
|
||||
|
||||
filters = [Notification.service_id == service_id]
|
||||
|
||||
if limit_days is not None:
|
||||
days_ago = date.today() - timedelta(days=limit_days)
|
||||
filters.append(func.date(Notification.created_at) >= days_ago)
|
||||
|
||||
if not include_jobs or (key_type and key_type != KEY_TYPE_NORMAL):
|
||||
filters.append(Notification.job_id.is_(None))
|
||||
|
||||
if key_type is not None:
|
||||
filters.append(Notification.key_type == key_type)
|
||||
|
||||
query = Notification.query.filter(*filters)
|
||||
query = _filter_query(query, filter_dict)
|
||||
if personalisation:
|
||||
query = query.options(
|
||||
joinedload('template_history')
|
||||
)
|
||||
|
||||
return query.order_by(desc(Notification.created_at)).paginate(
|
||||
page=page,
|
||||
per_page=page_size
|
||||
|
||||
Reference in New Issue
Block a user