Commit Graph
17 Commits
Author SHA1 Message Date
shamoon 06b2d5102c Fix GHSA-59xh-5vwx-4c4q 2026-03-15 17:13:08 -07:00
shamoon 5cc3c087d9 Security: enforce ownership for permission updates 2026-01-30 13:55:55 -08:00
shamoonandGitHub 2a9d1fce0d Chore: include password validation on user edit (#11308) 2025-11-07 11:20:27 -08:00
shamoonandGitHub 83391af866 Fix: more api fixes (#10204) 2025-06-19 08:28:41 -07:00
shamoonandGitHub 1a6f32534c Change: treat created as date not datetime (#9793) 2025-05-16 14:23:04 +00:00
shamoonandGitHub 3b19a727b8 Change: better handle permissions in patch requests (#9393) 2025-03-14 08:53:00 -07:00
shamoonandGitHub 1dc80f04cb Feature: openapi spec, full api browser (#8948) 2025-02-10 16:43:07 +00:00
shamoonandGitHub 79956d6a7b Enhancement: require totp code for obtain auth token (#8936) 2025-01-29 15:23:44 +00:00
shamoonandGitHub 41bcc12cc2 Change: restrict altering and creation of superusers to superusers only (#8837) 2025-01-20 11:57:22 -08:00
shamoonandGitHub 5e3ee3a80d Fix: disable API basic auth if MFA enabled (#8792) 2025-01-18 03:51:53 +00:00
shamoonandGitHub e94a92ed59 Feature: two-factor authentication (#8012) 2024-11-18 18:34:46 +00:00
martin f. krafftandGitHub 22a6360edf Fix: default order of documents gets lost in QuerySet pipeline (#6982)
* Send ordered document list to Django REST pagination

Currently, when pages of documents are requested from the API, the
webserver logs a warning:

```
gunicorn[1550]: /home/madduck/code/paperless-ngx/.direnv/python-3.11.2/lib/python3.11/site-packages/rest_framework/pagination.py:200: UnorderedObjectListWarning: Pagination may yield inconsistent results with an unordered object_list: <class 'documents.models.Document'> QuerySet.
```

This can yield unexpected and problematic results, including duplicate
and missing IDs in the enumeration, as demonstrated in
https://github.com/paperless-ngx/paperless-ngx/discussions/6859

The patch is simple: turn the unordered Documents QuerySet into
one that's ordered by reverse creation date, which is the default
ordering for `Document`.

Note that the default ordering for `Document` means that
`QuerySet.ordered` is actually `True` following the call to
`distinct()`, but after `annotate()`, the flag changes to `False`,
unless `order_by()` is used explicitly, as per this patch.

Closes: https://github.com/paperless-ngx/paperless-ngx/discussions/6859

Signed-off-by: martin f. krafft <madduck@madduck.net>

* Ensure order of documents in permissions test

The patch for #6982 changes the ordering of documents returned by the
API, which was previously implicit, and is now explicit. Therefore,
this patch masssages the API result to ensure the previous order.

Signed-off-by: martin f. krafft <madduck@madduck.net>

---------

Signed-off-by: martin f. krafft <madduck@madduck.net>
2024-06-13 14:46:18 +00:00
shamoonandGitHub f812f2af4d Fix: remove admin.logentry perm, use admin (staff) status (#6380) 2024-04-14 00:35:34 +00:00
shamoonandGitHub b643a68fa3 Enhancement: bulk delete objects (#5688) 2024-02-08 10:13:15 -08:00
shamoonandGitHub 454098630b Enhancement: mergeable bulk edit permissions (#5508) 2024-02-01 19:56:57 +00:00
shamoonandGitHub 5e8de4c1da Enhancement: shared icon & shared by me filter (#4859) 2023-12-19 20:45:04 +00:00
e2d25a7a09 Chore: reorganize api tests (#4935)
* Move permissions-related API tests

* Move bulk-edit-related API tests

* Move bulk-download-related API tests

* Move uisettings-related API tests

* Move remoteversion-related API tests

* Move tasks API tests

* Move object-related API tests

* Move consumption-template-related API tests

* Rename pared-down documents API test file

Co-Authored-By: Trenton H <797416+stumpylog@users.noreply.github.com>
2023-12-12 04:08:51 +00:00