feat(admin): django admin tweaks #4842
Conversation
…ueueAdmin Both admins now support filtering by date_created, and they display the date_created in the list.
![semgrep-app[bot]](https://avatars.githubusercontent.com/in/60555?s=60&v=4){kind=small}
…rAdmin class as methods This improves code organization by localizing user-admin-related logic to the UserAdmin class, enhancing readability and maintainability.
- Enable searching by description, docket__id, docket__case_name and recap_sequence_number - Display more fields in list view - Enable filtering by date_filed, date_created and date_modified
To improve performance in dockets with several entries, the inline was replaced by a button that redirects to the list of docket entries filtered by the docket, so they don't have to all be loaded when browsing a docket instance detail.
- Enable searching by pk, pacer_case_id and docket_number - Display more fields in list view
…elds to avoid overhead
To improve performance in dockets with several alerts, the inline was replaced by a button that redirects to the list of docket alerts filtered by the docket, so they don't have to all be loaded when browsing a docket instance detail.
| {% block object-tools-items %} | ||
| {% if docket_entries_url %} | ||
| <li> | ||
| <a class="historylink" href="{{ docket_entries_url }}"> |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (href="/{{link}}"). You may also consider setting the Content Security Policy (CSP) header.
To resolve this comment:
No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Leave a nosemgrep comment directly above or at the end of line 6 like so // nosemgrep: generic.html-templates.security.var-in-href.var-in-href
Take care to validate that this is not a true positive finding before ignoring it.
Learn more about ignoring code, files and folders here.
You can view more details about this finding in the Semgrep AppSec Platform.
| {% endif %} | ||
| {% if docket_alerts_url %} | ||
| <li> | ||
| <a class="historylink" href="{{ docket_alerts_url }}"> |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (href="/{{link}}"). You may also consider setting the Content Security Policy (CSP) header.
To resolve this comment:
No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Leave a nosemgrep comment directly above or at the end of line 13 like so // nosemgrep: generic.html-templates.security.var-in-href.var-in-href
Take care to validate that this is not a true positive finding before ignoring it.
Learn more about ignoring code, files and folders here.
You can view more details about this finding in the Semgrep AppSec Platform.
| {% endif %} | ||
| {% if profile_events_url %} | ||
| <li> | ||
| <a class="historylink" href="{{ profile_events_url }}"> |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (href="/{{link}}"). You may also consider setting the Content Security Policy (CSP) header.
To resolve this comment:
No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Leave a nosemgrep comment directly above or at the end of line 13 like so // nosemgrep: generic.html-templates.security.var-in-href.var-in-href
Take care to validate that this is not a true positive finding before ignoring it.
Learn more about ignoring code, files and folders here.
You can view more details about this finding in the Semgrep AppSec Platform.
| {% block object-tools-items %} | ||
| {% if proxy_events_url %} | ||
| <li> | ||
| <a class="historylink" href="{{ proxy_events_url }}"> |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (href="/{{link}}"). You may also consider setting the Content Security Policy (CSP) header.
To resolve this comment:
No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Leave a nosemgrep comment directly above or at the end of line 6 like so // nosemgrep: generic.html-templates.security.var-in-href.var-in-href
Take care to validate that this is not a true positive finding before ignoring it.
Learn more about ignoring code, files and folders here.
You can view more details about this finding in the Semgrep AppSec Platform.
Closes #2988
This PR introduces several small tweaks to the Django admin interface by:
UserProfileEventandUserProxyEvent.Events(*) andHistory:content_type. I noticed the loading time was extremely long when first loading a User instance detail view. Upon inspection I saw it was performing 795 queries, and after the optimization it went down to 21.jurisdiction.date_createdin theProcessingQueueAdminandPacerFetchQueueAdminlists.date_createdin theEmailProcessingQueueAdmin, and displaying thedate_createdanddate_modifiedas readonly fields in the instance detail.get_email_confirmedandget_stub_accounttoUserAdminclass as methods using the@admin.displaydecorator for better integration with the Django admin interface.DocketAdmin'scourtfield and to theSCOTUSMapAdmin'suserfield to avoid loading all of them at once, and to improve UX by allowing users to search for related instances.Note
(*) The
pghistorydefaultEventsbutton redirects to apghistoryadmin view that displays a table withpgh_diff, but I could not for the life of me get it to work in a way that felt useful:row=pghistory.Oldstatement in theUserProxymodel declaration, but the diff was always off, like it was one step behind, so the diff was very unclear. For example:first_email@example.com. This created a first event for theUserProxymodel with no diff, which makes sense.second_email@example.comand it did not create an event.third_email@example.com, and it did create an event, but it displayed the first two in the diff, stating I'd changed it fromfirst_email@example.comtosecond_email@example.com.This was all very confusing, and I decided it was much clearer to simply see the last snapshot of the instance via the registered admin. Maybe changing the
row=pghistory.Oldto the defaultrow=pghistory.Newwould help with this but I'm guessing that's there for a reason, and this alternative seemed good enough.CourtAdmin.DocketAdmin.date_createdtoProcessingQueueAdminandPacerFetchQueueAdminaslist_display.date_createdtoEmailProcessingQueueAdminaslist_displayand in the instance detail.DocketAdminslow loading times for instances with many entries.SCOTUSMapAdmininstance detail.