django-forms-workflows 0.77.5__tar.gz → 0.78.0__tar.gz

{django_forms_workflows-0.77.5 → django_forms_workflows-0.78.0}/PKG-INFO

@@ -1,22 +1,22 @@
 Metadata-Version: 2.4
 Name: django-forms-workflows
-Version: 0.77.5
+Version: 0.78.0
 Summary: Enterprise-grade, database-driven form builder with approval workflows and external data integration
 License: LGPL-3.0-only
 License-File: LICENSE
 Keywords: django,forms,workflows,approval,form-builder,dynamic-forms,ldap,enterprise,audit,database-driven,sso,saml,oauth2
 Author: Matt Davis
 Author-email: matt@opensensor.io
-Requires-Python: >=3.10,<4.0
+Requires-Python: >=3.11,<4.0
 Classifier: License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: 3.15
 Provides-Extra: all
+Provides-Extra: cache
 Provides-Extra: dev
 Provides-Extra: docs
 Provides-Extra: excel
@@ -31,7 +31,7 @@ Provides-Extra: postgresql
 Provides-Extra: qr
 Provides-Extra: saml
 Provides-Extra: sso
-Requires-Dist: Django (>=5.1,<7.0)
+Requires-Dist: Django (>=5.2.18,<7.0,!=6.0.0,!=6.0.1,!=6.0.2,!=6.0.3,!=6.0.4,!=6.0.5,!=6.0.6,!=6.0.7,!=6.0.8,!=6.1.0,!=6.1.1)
 Requires-Dist: celery (>=5.3)
 Requires-Dist: crispy-bootstrap5 (>=2.0)
 Requires-Dist: django-auth-ldap (>=4.0) ; extra == "ldap" or extra == "all"
@@ -44,7 +44,9 @@ Requires-Dist: google-auth (>=2.20) ; extra == "gmail" or extra == "all"
 Requires-Dist: markdown (>=3.4) ; extra == "markdown" or extra == "all"
 Requires-Dist: mssql-django (>=1.3) ; extra == "mssql" or extra == "all"
 Requires-Dist: mysqlclient (>=2.2) ; extra == "mysql" or extra == "all"
+Requires-Dist: nh3 (>=0.3.2)
 Requires-Dist: openpyxl (>=3.1) ; extra == "excel" or extra == "all"
+Requires-Dist: pillow (>=13.0.0) ; extra == "pdf" or extra == "all"
 Requires-Dist: psycopg2-binary (>=2.9) ; extra == "postgresql" or extra == "all"
 Requires-Dist: pyodbc (>=5.0) ; extra == "mssql" or extra == "all"
 Requires-Dist: pytest (>=7.4) ; extra == "dev"
@@ -53,6 +55,7 @@ Requires-Dist: pytest-django (>=4.5) ; extra == "dev"
 Requires-Dist: python-decouple (>=3.8)
 Requires-Dist: python-ldap (>=3.4) ; extra == "ldap" or extra == "all"
 Requires-Dist: python3-saml (>=1.16) ; extra == "sso" or extra == "saml" or extra == "all"
+Requires-Dist: redis (>=5.0) ; extra == "cache" or extra == "all"
 Requires-Dist: requests (>=2.31)
 Requires-Dist: ruff (>=0.4) ; extra == "dev"
 Requires-Dist: segno (>=1.6) ; extra == "qr" or extra == "all"
@@ -72,7 +75,7 @@ Description-Content-Type: text/markdown
 **Enterprise-grade, database-driven form builder with multi-stage approval workflows, external data integration, and cross-instance sync**
 
 [![License: LGPL v3](https://img.shields.io/badge/License-LGPL_v3-blue.svg)](https://www.gnu.org/licenses/lgpl-3.0)
-[![Python Version](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/downloads/)
+[![Python Version](https://img.shields.io/badge/python-3.11%2B-blue)](https://www.python.org/downloads/)
 [![Django Version](https://img.shields.io/badge/django-5.2%2B-green)](https://www.djangoproject.com/)
 [![Version](https://img.shields.io/badge/version-0.49.0-orange)](https://github.com/opensensor/django-forms-workflows)
 
@@ -258,6 +261,8 @@ Move form definitions between environments from the Django Admin:
 
 ## Quick Start
 
+See [security upgrade notes](docs/SECURITY_UPGRADE.md) before upgrading an existing deployment.
+
 ### Installation
 
 ```bash
@@ -413,8 +418,8 @@ graph TB
 
 ## Requirements
 
-- Python 3.10+
-- Django 5.2+
+- Python 3.11+
+- Django 5.2.18+, 6.0.9+, or 6.1.2+ (security patch minimums)
 - PostgreSQL, MySQL, or SQLite (PostgreSQL recommended for production)
 - Optional: Celery 5.0+ with Redis/Valkey for background task processing
 - Optional: `openpyxl` for Excel spreadsheet field support (`pip install django-forms-workflows[excel]`)

{django_forms_workflows-0.77.5 → django_forms_workflows-0.78.0}/README.md

@@ -3,7 +3,7 @@
 **Enterprise-grade, database-driven form builder with multi-stage approval workflows, external data integration, and cross-instance sync**
 
 [![License: LGPL v3](https://img.shields.io/badge/License-LGPL_v3-blue.svg)](https://www.gnu.org/licenses/lgpl-3.0)
-[![Python Version](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/downloads/)
+[![Python Version](https://img.shields.io/badge/python-3.11%2B-blue)](https://www.python.org/downloads/)
 [![Django Version](https://img.shields.io/badge/django-5.2%2B-green)](https://www.djangoproject.com/)
 [![Version](https://img.shields.io/badge/version-0.49.0-orange)](https://github.com/opensensor/django-forms-workflows)
 
@@ -189,6 +189,8 @@ Move form definitions between environments from the Django Admin:
 
 ## Quick Start
 
+See [security upgrade notes](docs/SECURITY_UPGRADE.md) before upgrading an existing deployment.
+
 ### Installation
 
 ```bash
@@ -344,8 +346,8 @@ graph TB
 
 ## Requirements
 
-- Python 3.10+
-- Django 5.2+
+- Python 3.11+
+- Django 5.2.18+, 6.0.9+, or 6.1.2+ (security patch minimums)
 - PostgreSQL, MySQL, or SQLite (PostgreSQL recommended for production)
 - Optional: Celery 5.0+ with Redis/Valkey for background task processing
 - Optional: `openpyxl` for Excel spreadsheet field support (`pip install django-forms-workflows[excel]`)

{django_forms_workflows-0.77.5 → django_forms_workflows-0.78.0}/django_forms_workflows/admin.py

@@ -1154,6 +1154,15 @@ class FormDefinitionAdmin(nested_admin.NestedModelAdmin):
 
     def sync_import_admin_view(self, request):
         """Admin page for importing form definitions from a JSON file or raw JSON."""
+        from django.core.exceptions import PermissionDenied
+
+        if not self.has_view_permission(request):
+            raise PermissionDenied
+        if not (
+            self.has_add_permission(request) and self.has_change_permission(request)
+        ):
+            raise PermissionDenied
+
         from .sync_api import import_payload
 
         context = dict(self.admin_site.each_context(request))
@@ -1219,6 +1228,15 @@ class FormDefinitionAdmin(nested_admin.NestedModelAdmin):
         Step 1 (POST) – fetch available forms from the remote, show checkbox list
         Step 2 (POST) – import selected forms, show results
         """
+        from django.core.exceptions import PermissionDenied
+
+        if not self.has_view_permission(request):
+            raise PermissionDenied
+        if not (
+            self.has_add_permission(request) and self.has_change_permission(request)
+        ):
+            raise PermissionDenied
+
         from .sync_api import (
             build_export_payload,
             fetch_remote_payload,
@@ -1372,6 +1390,11 @@ class FormDefinitionAdmin(nested_admin.NestedModelAdmin):
         Step 1 (POST) – show all local forms with checkboxes + diff status
         Step 2 (POST) – execute push for selected forms, show results
         """
+        from django.core.exceptions import PermissionDenied
+
+        if not self.has_view_permission(request):
+            raise PermissionDenied
+
         from .sync_api import (
             build_export_payload,
             fetch_remote_payload,

{django_forms_workflows-0.77.5 → django_forms_workflows-0.78.0}/django_forms_workflows/api_views.py

@@ -106,7 +106,7 @@ def require_api_token(view_func):
         raw = auth.removeprefix("Bearer ").strip()
         try:
             token_obj = APIToken.objects.select_related("user").get(
-                token=raw, is_active=True
+                token=raw, is_active=True, user__is_active=True
             )
         except (APIToken.DoesNotExist, ValueError, Exception):  # noqa: BLE001
             return JsonResponse({"error": "Invalid or inactive token."}, status=401)

{django_forms_workflows-0.77.5 → django_forms_workflows-0.78.0}/django_forms_workflows/apps.py

@@ -17,7 +17,7 @@ class DjangoFormsWorkflowsConfig(AppConfig):
         Import signal handlers and perform app initialization.
         """
         # Import signals to register handlers
-        from . import signals  # noqa: F401
+        from . import checks, signals  # noqa: F401
 
         # Load custom callback handlers from FORMS_WORKFLOWS_CALLBACKS setting
         from .callback_registry import load_from_settings

django_forms_workflows-0.78.0/django_forms_workflows/checks.py

@@ -0,0 +1,24 @@
+"""Deployment checks for public submission throttling."""
+
+from django.conf import settings
+from django.core.checks import Tags, Warning, register
+
+
+@register(Tags.security, deploy=True)
+def check_rate_limit_cache(app_configs, **kwargs):
+    alias = getattr(settings, "FORMS_WORKFLOWS_RATE_LIMIT_CACHE", "default")
+    backend = settings.CACHES.get(alias, {}).get("BACKEND", "")
+    if backend not in {
+        "django.core.cache.backends.redis.RedisCache",
+        "django.core.cache.backends.memcached.PyMemcacheCache",
+        "django.core.cache.backends.memcached.PyLibMCCache",
+        "django_redis.cache.RedisCache",
+    }:
+        return [
+            Warning(
+                "Public form rate limiting requires a shared cache with atomic add/incr.",
+                hint="Configure Redis or Memcached and FORMS_WORKFLOWS_RATE_LIMIT_CACHE; local-memory caches only limit one process.",
+                id="django_forms_workflows.W001",
+            )
+        ]
+    return []

{django_forms_workflows-0.77.5 → django_forms_workflows-0.78.0}/django_forms_workflows/diff_views.py

@@ -8,6 +8,7 @@ from django.http import HttpResponseBadRequest
 from django.shortcuts import render
 
 from .models import FormDefinition
+from .security import builder_permission_required
 from .sync_api import build_export_payload
 
 
@@ -429,6 +430,7 @@ def _build_summary(forms_data):
     return summaries
 
 
+@builder_permission_required("view_formdefinition")
 def diff_forms_view(request):
     """Render a side-by-side JSON diff of selected FormDefinitions."""
     pks = request.GET.get("pks", "")

{django_forms_workflows-0.77.5 → django_forms_workflows-0.78.0}/django_forms_workflows/form_builder_views.py

@@ -26,11 +26,13 @@ from .models import (
     WorkflowDefinition,
     WorkflowStage,
 )
+from .security import builder_permission_required
 
 logger = logging.getLogger(__name__)
 
 
 @require_GET
+@builder_permission_required("view_formtemplate")
 def form_builder_templates(request):
     """
     API endpoint to list available form templates.
@@ -63,6 +65,7 @@ def form_builder_templates(request):
 
 
 @require_GET
+@builder_permission_required("view_formtemplate")
 def form_builder_load_template(request, template_id):
     """
     API endpoint to load a form template.
@@ -83,6 +86,7 @@ def form_builder_load_template(request, template_id):
 
 
 @require_POST
+@builder_permission_required("view_formdefinition", "add_formdefinition")
 def form_builder_clone(request, form_id):
     """
     API endpoint to clone an existing form.
@@ -225,6 +229,7 @@ def form_builder_clone(request, form_id):
 
 
 @require_GET
+@builder_permission_required("view_formdefinition")
 def form_builder_view(request, form_id=None):
     """
     Main form builder page.
@@ -269,6 +274,7 @@ def form_builder_view(request, form_id=None):
 
 
 @require_GET
+@builder_permission_required("view_formdefinition")
 def form_builder_load(request, form_id):
     """
     API endpoint to load form data as JSON.
@@ -353,6 +359,7 @@ def form_builder_load(request, form_id):
 
 
 @require_POST
+@builder_permission_required("save_formdefinition")
 def form_builder_save(request):
     """
     API endpoint to save form data.
@@ -604,6 +611,7 @@ def save_form_definition_from_builder_data(data, user, form_definition=None):
 
 
 @require_POST
+@builder_permission_required("view_formdefinition")
 def form_builder_preview(request):
     """
     API endpoint to generate a preview of the form.
@@ -764,6 +772,7 @@ def form_builder_preview(request):
 
 
 @require_GET
+@builder_permission_required("view_formdefinition", "view_documenttemplate")
 def document_template_list(request, form_id):
     """List document templates for a form."""
     templates = DocumentTemplate.objects.filter(form_definition_id=form_id).order_by(
@@ -789,6 +798,7 @@ def document_template_list(request, form_id):
 
 
 @require_POST
+@builder_permission_required("change_formdefinition", "save_documenttemplate")
 def document_template_save(request, form_id):
     """Create or update a document template."""
     try:
@@ -847,6 +857,7 @@ def document_template_save(request, form_id):
 
 
 @require_POST
+@builder_permission_required("change_formdefinition", "delete_documenttemplate")
 def document_template_delete(request, form_id, template_id):
     """Delete a document template."""
     tpl = get_object_or_404(
@@ -862,6 +873,7 @@ def document_template_delete(request, form_id, template_id):
 
 
 @require_GET
+@builder_permission_required("view_sharedoptionlist")
 def shared_option_list_api(request):
     """List all shared option lists (for form builder dropdowns)."""
     lists = SharedOptionList.objects.filter(is_active=True).order_by("name")
@@ -882,6 +894,7 @@ def shared_option_list_api(request):
 
 
 @require_POST
+@builder_permission_required("save_sharedoptionlist")
 def shared_option_list_save(request):
     """Create or update a shared option list."""
     try:
@@ -924,6 +937,7 @@ def shared_option_list_save(request):
 
 
 @require_POST
+@builder_permission_required("delete_sharedoptionlist")
 def shared_option_list_delete(request, list_id):
     """Delete a shared option list."""
     ol = get_object_or_404(SharedOptionList, id=list_id)

{django_forms_workflows-0.77.5 → django_forms_workflows-0.78.0}/django_forms_workflows/forms.py

@@ -333,18 +333,6 @@ class DynamicForm(forms.Form):
         # files).  Also used to carry forward draft / resubmit file data.
         self.stashed_files = stashed_files or {}
 
-        # Recover stashed-file metadata carried forward via hidden input from
-        # a prior validation-failure render (browsers cannot re-send files).
-        if not self.stashed_files and self.data:
-            prev = self.data.get("_stashed_files")
-            if prev:
-                try:
-                    self.stashed_files = json.loads(prev)
-                except (json.JSONDecodeError, TypeError):
-                    # Ignore malformed client metadata; uploaded files are rebuilt
-                    # from validated server-side data below.
-                    pass
-
         # Build form fields from definition
         # Exclude fields scoped to a workflow stage - those are for approvers only
         for field in (
@@ -354,15 +342,6 @@ class DynamicForm(forms.Form):
         ):
             self.add_field(field, initial_data)
 
-        # Embed stashed-file metadata as a hidden field so it survives
-        # validation-failure round-trips (browsers cannot re-send files).
-        if self.stashed_files:
-            self.fields["_stashed_files"] = forms.CharField(
-                widget=forms.HiddenInput(),
-                required=False,
-                initial=json.dumps(self.stashed_files),
-            )
-
         # Setup form layout with Crispy Forms
         self.helper = FormHelper()
         self.helper.form_method = "post"
@@ -763,7 +742,7 @@ class DynamicForm(forms.Form):
             # failure, saved with a draft, or carried from a resubmission).
             existing_file = self._get_existing_file_info(field_def.field_name)
             if existing_file:
-                fname = existing_file.get("filename", "file")
+                fname = html_escape(existing_file.get("filename", "file"))
                 extra_help = f"Previously uploaded: <strong>{fname}</strong>. Leave blank to keep it."
                 base_help = field_args.get("help_text", "") or ""
                 field_args["help_text"] = (
@@ -789,10 +768,11 @@ class DynamicForm(forms.Form):
                     if isinstance(existing_file, list)
                     else existing_file.get("filename", "file")
                 )
-                extra = f"Previously uploaded: <strong>{names}</strong>. Leave blank to keep."
+                extra = f"Previously uploaded: <strong>{html_escape(names)}</strong>. Leave blank to keep."
                 help_text = f"{help_text} {extra}" if help_text else extra
                 required = False
             self.fields[field_def.field_name] = MultipleFileField(
+                validators=_build_file_validators(field_def),
                 required=required,
                 label=field_def.field_label,
                 help_text=help_text,
@@ -931,12 +911,13 @@ class DynamicForm(forms.Form):
             )
 
         elif field_def.field_type == "display_text":
-            display_html = _render_display_text(initial or field_def.default_value)
+            display_html = _render_display_text(field_def.default_value)
             self.fields[field_def.field_name] = forms.CharField(
                 required=False,
                 label=field_def.field_label,
                 help_text=field_def.help_text,
-                initial=initial or field_def.default_value,
+                initial=field_def.default_value,
+                disabled=True,
                 widget=DisplayTextWidget(
                     display_html=display_html,
                     attrs={"data-display-text": "true"},

{django_forms_workflows-0.77.5 → django_forms_workflows-0.78.0}/django_forms_workflows/models.py

@@ -881,6 +881,8 @@ class DocumentTemplate(models.Model):
         """Render this template with submission data, returning HTML string."""
         import re
 
+        from django.utils.html import escape
+
         form_data = submission.form_data or {}
 
         # Build merge context with system variables + form data
@@ -906,6 +908,7 @@ class DocumentTemplate(models.Model):
             else:
                 context[key] = str(val) if val is not None else ""
 
+        context = {key: str(escape(value)) for key, value in context.items()}
         html = self.html_content
 
         # Process conditional blocks: {% if field_name %}...{% endif %}

django_forms_workflows-0.78.0/django_forms_workflows/pdf.py

@@ -0,0 +1,53 @@
+"""PDF resources are offline by default, including CSS and SVG subresources."""
+
+import base64
+import binascii
+
+from django.conf import settings
+
+
+def safe_pdf_url_fetcher(url, *args, **kwargs):
+    """Allow bounded embedded raster images; never open files or network URLs.
+
+    Logos/signatures should be embedded as data:image/png;base64,... (or JPEG).
+    A deployment needing additional resources can supply a reviewed fetcher via
+    FORMS_WORKFLOWS_PDF_URL_FETCHER. It must enforce its own allowlist and limits.
+    """
+    limit = getattr(settings, "FORMS_WORKFLOWS_PDF_MAX_RESOURCE_BYTES", 5 * 1024 * 1024)
+    if len(url) > limit * 4 // 3 + 128:
+        raise ValueError("PDF resource exceeds size limit")
+    header, sep, encoded = url.partition(",")
+    if not sep or header not in ("data:image/png;base64", "data:image/jpeg;base64"):
+        raise ValueError("PDF resource URL is not permitted")
+    try:
+        data = base64.b64decode(encoded, validate=True)
+    except (ValueError, binascii.Error) as exc:
+        raise ValueError("Invalid PDF image") from exc
+    mime = header[5:].split(";")[0]
+    signature = b"\x89PNG\r\n\x1a\n" if mime == "image/png" else b"\xff\xd8\xff"
+    if len(data) > limit or not data.startswith(signature):
+        raise ValueError("Invalid PDF image")
+    return {"string": data, "mime_type": mime}
+
+
+def pdf_url_fetcher():
+    from django.utils.module_loading import import_string
+
+    custom = getattr(settings, "FORMS_WORKFLOWS_PDF_URL_FETCHER", None)
+    if custom:
+        factory = import_string(custom)
+        return factory()
+    # WeasyPrint 70 replaced dictionary-returning callables with URLFetcher.
+    try:
+        from weasyprint.urls import URLFetcher, URLFetcherResponse
+    except ImportError:
+        return safe_pdf_url_fetcher
+
+    class OfflineFetcher(URLFetcher):
+        def fetch(self, url, headers=None):
+            resource = safe_pdf_url_fetcher(url)
+            return URLFetcherResponse(
+                url, resource["string"], {"Content-Type": resource["mime_type"]}
+            )
+
+    return OfflineFetcher(allowed_protocols={"data"}, allow_redirects=False)

{django_forms_workflows-0.77.5 → django_forms_workflows-0.78.0}/django_forms_workflows/reporting_views.py

@@ -18,17 +18,31 @@ from django.shortcuts import render
 from django.utils import timezone
 from django.utils.safestring import mark_safe
 
-from .models import ApprovalTask, FormDefinition, FormSubmission
+from .models import ApprovalTask, FormDefinition
+from .security import visible_submissions
+
+
+def _range_days(request):
+    try:
+        return max(1, min(int(request.GET.get("days", 90)), 3660))
+    except (TypeError, ValueError):
+        return 90
+
+
+def _csv_cell(value):
+    if isinstance(value, str) and value.lstrip().startswith(("=", "+", "-", "@")):
+        return "'" + value
+    return value
 
 
 @login_required
 def analytics_export_csv(request):
     """Export analytics summary data as CSV."""
-    range_days = int(request.GET.get("days", 90))
+    range_days = _range_days(request)
     cutoff = timezone.now() - timedelta(days=range_days)
     form_slug = request.GET.get("form", "")
 
-    submissions_qs = FormSubmission.objects.exclude(status="draft")
+    submissions_qs = visible_submissions(request.user).exclude(status="draft")
     if form_slug:
         submissions_qs = submissions_qs.filter(form_definition__slug=form_slug)
 
@@ -46,15 +60,18 @@ def analytics_export_csv(request):
     ).order_by("-created_at"):
         writer.writerow(
             [
-                sub.created_at.strftime("%Y-%m-%d %H:%M"),
-                sub.form_definition.name if sub.form_definition else "",
-                sub.status,
-                (
-                    sub.submitter.get_full_name() or sub.submitter.username
-                    if sub.submitter
-                    else "Anonymous"
-                ),
-                sub.id,
+                _csv_cell(value)
+                for value in [
+                    sub.created_at.strftime("%Y-%m-%d %H:%M"),
+                    sub.form_definition.name if sub.form_definition else "",
+                    sub.status,
+                    (
+                        sub.submitter.get_full_name() or sub.submitter.username
+                        if sub.submitter
+                        else "Anonymous"
+                    ),
+                    sub.id,
+                ]
             ]
         )
 
@@ -66,14 +83,14 @@ def analytics_dashboard(request):
     """Render the analytics dashboard with submission & approval metrics."""
 
     # ── Time range filter ───────────────────────────────────────────────
-    range_days = int(request.GET.get("days", 90))
+    range_days = _range_days(request)
     cutoff = timezone.now() - timedelta(days=range_days)
     prev_cutoff = cutoff - timedelta(days=range_days)  # Previous period
     form_slug = request.GET.get("form", "")
 
     # Base querysets
-    submissions_qs = FormSubmission.objects.exclude(status="draft")
-    tasks_qs = ApprovalTask.objects.all()
+    submissions_qs = visible_submissions(request.user).exclude(status="draft")
+    tasks_qs = ApprovalTask.objects.filter(submission__in=submissions_qs)
 
     if form_slug:
         submissions_qs = submissions_qs.filter(form_definition__slug=form_slug)
@@ -195,7 +212,7 @@ def analytics_dashboard(request):
     # ── 7. Bottleneck stages ────────────────────────────────────────────
     # Stages with the most pending tasks right now
     bottleneck_stages = list(
-        ApprovalTask.objects.filter(status="pending", workflow_stage__isnull=False)
+        tasks_qs.filter(status="pending", workflow_stage__isnull=False)
         .values(
             "workflow_stage__name", "workflow_stage__workflow__form_definition__name"
         )
@@ -232,13 +249,16 @@ def analytics_dashboard(request):
 
     # ── Available forms for filter dropdown ─────────────────────────────
     available_forms = list(
-        FormDefinition.objects.filter(is_active=True)
+        FormDefinition.objects.filter(
+            is_active=True, submissions__in=visible_submissions(request.user)
+        )
+        .distinct()
         .values_list("slug", "name")
         .order_by("name")
     )
 
     # ── 10. Overdue tasks ───────────────────────────────────────────────
-    overdue_count = ApprovalTask.objects.filter(
+    overdue_count = tasks_qs.filter(
         status="pending",
         due_date__isnull=False,
         due_date__lt=timezone.now(),
@@ -256,7 +276,12 @@ def analytics_dashboard(request):
                 else:
                     clean[k] = v
             serializable.append(clean)
-        return mark_safe(json.dumps(serializable))
+        return mark_safe(
+            json.dumps(serializable)
+            .replace("<", "\\u003C")
+            .replace(">", "\\u003E")
+            .replace("&", "\\u0026")
+        )
 
     context = {
         "range_days": range_days,