Security Patches: IDOR and XSS Fixes

.gitignore

@@ -60,6 +60,8 @@ website/db.sqlit
 .env
 .venv
 env/
+myEnv/
+myenv/
 venv/
 ENV/
 env.bak/
@@ -83,4 +85,7 @@ website/events_calendar/migrations/
 website/migrations/
 
 # Media files
-media/
+media/
+
+staticfiles/
+.agent/

README.md

@@ -1,24 +1,180 @@
-# RECursionNITD-website
+# RECursion NITD Website Backend
 
-steps to install
+## Project Title
 
-1. create python virtualenv
-2. install all packages from requirements.txt
-3. create .env file in project root (website/) with dbdetails
+**RECursion NITD Website Backend**
 
-sample:
+## Functionalities
 
+- User registration, login, and profile management
+- Forum with questions, answers, and discussions
+- Event creation, listing, updating, and details
+- Interview experience sharing and browsing
+- Blog content management
+- Team member pages and team-related data
+- Calendar-related event APIs
+- Google social authentication
+- Email notification support using SMTP
+- REST API endpoints for frontend integration
+
+## Tech Stack
+
+- Python 3.11
+- Django 3.2
+- Django REST Framework
+- Django Filters
+- Django MarkdownX
+- Django Prometheus
+- social-auth-app-django
+- dj-database-url
+- python-decouple / python-dotenv
+
+## Project Structure
+
+- `requirements.txt` — project dependencies
+- `website/` — Django application root
+  - `manage.py` — Django management script
+  - `website/` — project settings and URL configuration
+    - `settings.py` — application settings
+    - `urls.py` — root URL routing
+    - `wsgi.py` — WSGI entrypoint
+  - `blog/` — blog application
+  - `events/` — event management application
+  - `events_calendar/` — calendar API application
+  - `forum/` — forum application
+  - `getting_started/` — onboarding and guides app
+  - `team/` — team management app
+  - `user_profile/` — user profile and account app
+  - `interview_exp/` — interview experience app
+  - `utils/` — shared utilities
+
+## Local Setup
+
+### 1. Prerequisites
+
+- Python 3.11
+- pip
+- Git
+- Optional: Microsoft Visual C++ Build Tools if package compilation fails
+
+#### Install Python 3.11
+
+- Download Python 3.11 from the official website:  
+  https://www.python.org/downloads/release/python-3110/
+- *Windows (via winget)*: winget install -e --id Python.Python.3.11
+- *macOS (via Homebrew)*: brew install python@3.11
+- *Linux (Ubuntu/Debian)*: sudo apt update && sudo apt install python3.11 python3.11-venv
+
+
+Verify Python version:
+
+```python --version```
+
+Expected output:
+
+```Python 3.11.x```
+
+### 2. Fork and Clone the Repository
+
+- Go to:
+  https://github.com/RECursion-NITD/RECursionNITD-website
+
+- Click Fork to create your own copy
+
+- Clone your fork:
+
+```
+git clone https://github.com/<your-username>/RECursionNITD-website.git
+cd RECursionNITD-website
+
+Add upstream remote:
+
+git remote add upstream https://github.com/RECursion-NITD/RECursionNITD-website.git
+git remote -v
+
+Checkout development branch:
+
+git checkout dev-api
 ```
-DB_NAME=HELLO_DJANGO
-DB_USER=U_HELLO
-DB_PASSWORD=hA8(scA@!fg3*sc&xaGh&6%-l<._&xCf
-DB_HOST=127.0.0.1
-DB_PORT=""
 
-SOCIAL_AUTH_GOOGLE_OAUTH2_KEY='googlekey'
-SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET='googleSECRET'
+### 3. Create a virtual environment
+
+```powershell
+python -m venv venv
 ```
 
-4. run ```python manage.py makemigrations```
-5. run ```python manage.py migrate```
-6. run ```python manage.py runserver```
+### 4. Activate the virtual environment
+
+```powershell
+.\venv\Scripts\Activate.ps1
+```
+
+If you are using Command Prompt:
+
+```cmd
+venv\Scripts\activate.bat
+```
+
+### 5. Install dependencies
+
+```powershell
+python -m pip install --upgrade pip setuptools wheel
+python -m pip install -r requirements.txt
+```
+
+### 6. Add the database file
+
+Place the downloaded database file here:
+
+```text
+website/db.sqlite3
+```
+
+### 7. Extract media files
+
+Extract the downloaded `media.zip` into the `website/` folder.
+
+### 8. Create `website/.env`
+
+Create the env file and add the required configuration values. Do not commit secrets.
+
+### 9. Apply database migrations
+
+```powershell
+cd website
+python manage.py makemigrations
+python manage.py migrate
+```
+
+### 10. Collect static files
+
+```powershell
+python manage.py collectstatic --noinput
+```
+
+### 11. Run the development server
+
+```powershell
+python manage.py runserver
+```
+
+Open the site at:
+
+```text
+http://127.0.0.1:8000/
+```
+
+## Contribution
+
+- Create a separate branch for each change: `git checkout -b feature/your-change`
+- Keep pull requests focused and small
+- Add a clear title and description for each PR
+- Include testing or setup steps in the PR description
+- Request review from the team or maintainer
+
+## Notes
+
+- Environment variables should be stored in `website/.env` and kept private.
+- If `DATABASE_URL` is not provided, the project defaults to SQLite at `website/db.sqlite3`.
+- If using SQLite locally, database host/user/password settings are not required.
+- The frontend repository is separate: `https://github.com/RECursion-NITD/RECursionNITD-Frontend`

website/blog/forms.py

@@ -7,6 +7,7 @@
 from django.contrib.auth.forms import UserCreationForm
 from markdownx.fields import MarkdownxFormField
 from markdownx.utils import markdownify
+from utils.content_filter import sanitize_markdown
 
 class Postform(forms.ModelForm):
     title = models.CharField(max_length=100)
@@ -16,7 +17,7 @@ def clean_description(self):
         data = self.cleaned_data['description']
         if len(data)<20:
             raise forms.ValidationError("Description too Short! Less than 20 words!")
-        data = markdownify(data)
+        data = sanitize_markdown(markdownify(data))
         return data
 
     class Meta:
@@ -42,7 +43,7 @@ class Replyform(forms.ModelForm):
 
     def clean_description(self):
         data = self.cleaned_data['description']
-        data = markdownify(data)
+        data = sanitize_markdown(markdownify(data))
         return data
 
 
@@ -55,7 +56,7 @@ class Commentform(forms.ModelForm):
 
     def clean_body(self):
         data = self.cleaned_data['body']
-        data = markdownify(data)
+        data = sanitize_markdown(markdownify(data))
         return data
 
     class Meta:
@@ -67,7 +68,7 @@ class Comment_Replyform(forms.ModelForm):
 
     def clean_body(self):
         data = self.cleaned_data['body']
-        data = markdownify(data)
+        data = sanitize_markdown(markdownify(data))
         return data
 
     class Meta:

website/blog/templates/blog/blog_list.html

@@ -1,4 +1,6 @@
+{% load static %}
 {% load blog_tags %}
+
 {% for post in posts %} 
 <li class="col-sm-12 col-lg-12 ques_div mt-2 mb-1" id="content">
     <ul id="attributeList">
@@ -7,56 +9,63 @@
             <div class="col-sm-1 col-lg-1 mr-2">
                 {% for p in profile %}
                     {% if p.user == post.user_id %}
-                <img src="{{ p.image.url }}" class="rounded-circle mt-2 mb-1" width="55px" height="55px" alt="img">
+                        {% if p.image %}
+                            <img src="{{ p.image.url }}" class="rounded-circle mt-2 mb-1" width="55px" height="55px" alt="img">
+                        {% else %}
+                            <img src="{% static 'image/profile_pic/default.png' %}" class="rounded-circle mt-2 mb-1" width="55px" height="55px" alt="default">
+                        {% endif %}
                     {% endif %}
                 {% endfor %}    
             </div>    
+
             <div class="col-lg-6 col-sm-12">
                 <div>
-                    <a id="questionDetail" href="{% url 'blog:detail_blogs' post.id  %}">
+                    <a id="questionDetail" href="{% url 'blog:detail_blogs' post.id %}">
                         <strong>{{ post.title }}</strong>
                     </a>
                     <br>
                 </div>
+
                 <div id="addedBy" class="text-muted">
-                    <li>Posted by <a href="{% url 'user_profile:view_profile' post.user_id.id  %}">{{post.user_id}}</a> on</li>
+                    <li>Posted by <a href="{% url 'user_profile:view_profile' post.user_id.id %}">{{ post.user_id }}</a> on</li>
                 </div>
-                <li id="postedOn" class="text-muted">{{post.created_at}}</li>
+
+                <li id="postedOn" class="text-muted">{{ post.created_at }}</li>
                 <br>
+
                 <li id="tagList">
                     <ul>
-                        {% for tagging in taggings %} 
-                          {% if tagging.post == post %} 
-                            {% for tag in tags %} 
-                              {% if tagging.tag == tag %}
-                              {% comment %} <li class="tagName" class="font-italic text-muted">{{tag.name}}</li> {% endcomment %}
-                              <li style="display:inline-block;"><a class="tagName" href="{% url 'blog:filter_blog' tag.id  %}">{{ tag.name }}</a></li>
-                              {% endif %} 
-                            {% endfor %} 
-                          {%endif%} 
+                        {% for tagging in taggings %}
+                            {% if tagging.post == post %}
+                                {% for tag in tags %}
+                                    {% if tagging.tag == tag %}
+                                        <li style="display:inline-block;">
+                                            <a class="tagName" href="{% url 'blog:filter_blog' tag.id %}">{{ tag.name }}</a>
+                                        </li>
+                                    {% endif %}
+                                {% endfor %}
+                            {% endif %}
                         {% endfor %}
                     </ul>
                 </li>
             </div>
-                <!-- <div id="AnswerFollow_block" style="display: inline-block;"> -->
-                    <div class="col-sm-5 col-md-3 col-lg-3 mt-auto mb-auto" id="answerBox" style="display: inline-block;">
-                      <div class="row">
-                          <div class="col-sm-6">
-                            {%if post.reply_set.count == 1 %}
-                            <span id="followValue" style="font-size:70%;">{{ post.reply_set.count }} comment
-                            {%else %}
-                            <span id="followValue" style="font-size:70%;">{{ post.reply_set.count }} comments
-                            {%endif%}
-                            </span>
-                          </div>
-                          <div class="col-sm-5 col-md-3 col-lg-6" id="followBox" style="display: inline-block;">
-                            <span id="followValue" style="font-size:70%;">{{post.id|postlike_count}} vote(s)</span>
-                          </div>
-                      </div>
+
+            <div class="col-sm-5 col-md-3 col-lg-3 mt-auto mb-auto" id="answerBox" style="display:inline-block;">
+                <div class="row">
+                    <div class="col-sm-6">
+                        {% if post.reply_set.count == 1 %}
+                            <span id="followValue" style="font-size:70%;">{{ post.reply_set.count }} comment</span>
+                        {% else %}
+                            <span id="followValue" style="font-size:70%;">{{ post.reply_set.count }} comments</span>
+                        {% endif %}
                     </div>
-                <!-- </div> -->
-          </div>
+                    <div class="col-sm-5 col-md-3 col-lg-6" id="followBox" style="display:inline-block;">
+                        <span id="followValue" style="font-size:70%;">{{ post.id|postlike_count }} vote(s)</span>
+                    </div>
+                </div>
+            </div>
+        </div>
     </ul>
 </li>
-<hr> 
-{% endfor %}
+<hr>
+{% endfor %}