Ensure that querying for notifications does not return CSV data unless:

- It's explicitly asked for AND
- you are using a LIVE key

Team and Test keys CANNOT retrieve CSV/Job derived notifications
This commit is contained in:
Martyn Inglis
2016-09-15 15:59:02 +01:00
parent c67c819f0a
commit 9f02e94f38
2 changed files with 202 additions and 10 deletions

View File

@@ -21,7 +21,7 @@ from app.models import (
NOTIFICATION_CREATED,
NOTIFICATION_SENDING,
NOTIFICATION_PENDING,
NOTIFICATION_TEMPORARY_FAILURE)
NOTIFICATION_TEMPORARY_FAILURE, KEY_TYPE_NORMAL)
from app.dao.dao_utils import transactional
from app.statsd_decorators import statsd
@@ -232,24 +232,29 @@ def get_notifications_for_service(service_id,
page_size=None,
limit_days=None,
key_type=None,
personalisation=False):
personalisation=False,
include_jobs=False):
if page_size is None:
page_size = current_app.config['PAGE_SIZE']
filters = [Notification.service_id == service_id]
if limit_days is not None:
days_ago = date.today() - timedelta(days=limit_days)
filters.append(func.date(Notification.created_at) >= days_ago)
if not include_jobs or (key_type and key_type != KEY_TYPE_NORMAL):
filters.append(Notification.job_id.is_(None))
if key_type is not None:
filters.append(Notification.key_type == key_type)
query = Notification.query.filter(*filters)
query = _filter_query(query, filter_dict)
if personalisation:
query = query.options(
joinedload('template_history')
)
return query.order_by(desc(Notification.created_at)).paginate(
page=page,
per_page=page_size