Commit Graph

17 Commits

Author SHA1 Message Date
shamoon 06b2d5102c Fix GHSA-59xh-5vwx-4c4q 2026-03-15 17:13:08 -07:00
shamoon 5cc3c087d9 Security: enforce ownership for permission updates 2026-01-30 13:55:55 -08:00
shamoon 2a9d1fce0d Chore: include password validation on user edit (#11308) 2025-11-07 11:20:27 -08:00
shamoon 83391af866 Fix: more api fixes (#10204) 2025-06-19 08:28:41 -07:00
shamoon 1a6f32534c Change: treat created as date not datetime (#9793) 2025-05-16 14:23:04 +00:00
shamoon 3b19a727b8 Change: better handle permissions in patch requests (#9393) 2025-03-14 08:53:00 -07:00
shamoon 1dc80f04cb Feature: openapi spec, full api browser (#8948) 2025-02-10 16:43:07 +00:00
shamoon 79956d6a7b Enhancement: require totp code for obtain auth token (#8936) 2025-01-29 15:23:44 +00:00
shamoon 41bcc12cc2 Change: restrict altering and creation of superusers to superusers only (#8837) 2025-01-20 11:57:22 -08:00
shamoon 5e3ee3a80d Fix: disable API basic auth if MFA enabled (#8792) 2025-01-18 03:51:53 +00:00
shamoon e94a92ed59 Feature: two-factor authentication (#8012) 2024-11-18 18:34:46 +00:00
martin f. krafft 22a6360edf Fix: default order of documents gets lost in QuerySet pipeline (#6982)
* Send ordered document list to Django REST pagination

Currently, when pages of documents are requested from the API, the
webserver logs a warning:

```
gunicorn[1550]: /home/madduck/code/paperless-ngx/.direnv/python-3.11.2/lib/python3.11/site-packages/rest_framework/pagination.py:200: UnorderedObjectListWarning: Pagination may yield inconsistent results with an unordered object_list: <class 'documents.models.Document'> QuerySet.
```

This can yield unexpected and problematic results, including duplicate
and missing IDs in the enumeration, as demonstrated in
https://github.com/paperless-ngx/paperless-ngx/discussions/6859

The patch is simple: turn the unordered Documents QuerySet into
one that's ordered by reverse creation date, which is the default
ordering for `Document`.

Note that the default ordering for `Document` means that
`QuerySet.ordered` is actually `True` following the call to
`distinct()`, but after `annotate()`, the flag changes to `False`,
unless `order_by()` is used explicitly, as per this patch.

Closes: https://github.com/paperless-ngx/paperless-ngx/discussions/6859

Signed-off-by: martin f. krafft <madduck@madduck.net>

* Ensure order of documents in permissions test

The patch for #6982 changes the ordering of documents returned by the
API, which was previously implicit, and is now explicit. Therefore,
this patch masssages the API result to ensure the previous order.

Signed-off-by: martin f. krafft <madduck@madduck.net>

---------

Signed-off-by: martin f. krafft <madduck@madduck.net>
2024-06-13 14:46:18 +00:00
shamoon f812f2af4d Fix: remove admin.logentry perm, use admin (staff) status (#6380) 2024-04-14 00:35:34 +00:00
shamoon b643a68fa3 Enhancement: bulk delete objects (#5688) 2024-02-08 10:13:15 -08:00
shamoon 454098630b Enhancement: mergeable bulk edit permissions (#5508) 2024-02-01 19:56:57 +00:00
shamoon 5e8de4c1da Enhancement: shared icon & shared by me filter (#4859) 2023-12-19 20:45:04 +00:00
shamoon e2d25a7a09 Chore: reorganize api tests (#4935)
* Move permissions-related API tests

* Move bulk-edit-related API tests

* Move bulk-download-related API tests

* Move uisettings-related API tests

* Move remoteversion-related API tests

* Move tasks API tests

* Move object-related API tests

* Move consumption-template-related API tests

* Rename pared-down documents API test file

Co-Authored-By: Trenton H <797416+stumpylog@users.noreply.github.com>
2023-12-12 04:08:51 +00:00