django-whiteneuron 0.2.42__tar.gz → 0.2.44__tar.gz

{django_whiteneuron-0.2.42 → django_whiteneuron-0.2.44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-whiteneuron
-Version: 0.2.42
+Version: 0.2.44
 Summary: A modern Django Admin extension with enhanced UI/UX, dashboard, feedback, file management, rate limiting, IP blacklisting, and advanced admin integrations built on django-unfold.
 Author-email: White Neuron <anhnt@whiteneuron.com>
 License: MIT License
@@ -94,7 +94,7 @@ A modern Django Admin extension focused on UI/UX, dashboard, feedback, file mana
 
 ## Current Version
 
-- 0.2.42
+- 0.2.44
 
 ## Compatibility
 
@@ -105,7 +105,30 @@ A modern Django Admin extension focused on UI/UX, dashboard, feedback, file mana
 
 ## Changelog
 
-### v0.2.42 (2026-03-31) — latest
+### v0.2.44 (2026-04-02) — latest
+**Fixes & Improvements: Feedback System — Error handling, input limits, i18n lazy evaluation**
+- **Fixed**: `changeform_view` now returns `JsonResponse({"success": True})` after a successful resolve instead of falling through to `super()` with a POST request — prevents a spurious HTTP 403 caused by `has_change_permission = False`.
+- **Fixed**: `note` is read from `request.POST` instead of `request.GET` — prevents HTTP 414 (URI Too Long) when the note is lengthy.
+- **Fixed**: JS `fetch` upgraded to POST + `FormData` with CSRF token; error handling now maps status codes (403/404/500/network) to specific user-facing messages.
+- **Added**: Two-sided character limits — `maxlength` attribute + live counter on client; server-side validation: `note ≤ 500`, `feedback_message ≤ 2000`.
+- **Added**: `get_short_message()` in `FeedbackDataAdmin.list_display` — truncates to 200 words via Django's `Truncator`.
+- **Fixed**: `search_help_text` moved from `__init__` to a `@property` using `format_lazy` — now re-evaluates per request and responds correctly to language switches instead of being frozen at server startup.
+
+### v0.2.43 (2026-04-01)
+**Feature: Feedback System — DaisyUI modals, anti-spam cooldown, i18n, security hardening**
+- **Added**: DaisyUI `<dialog>` modals replace native `prompt()`/`alert()` in both `feedback_change_form.html` (Mark as Resolved flow) and `submit_line.html` (Feedback submission) — smooth animations, no browser dialogs.
+- **Added**: Server-side anti-spam cooldown — 60s per user globally; HTTP 429 with dynamically calculated remaining seconds (`remaining = 60 - elapsed`).
+- **Security**: Replaced `@csrf_exempt` with `@require_POST` in feedback endpoint — CSRF protection fully enforced via `X-CSRFToken` header.
+- **Security**: Auth check moved before body parse; removed redundant `User.objects.get()` in favor of `request.user`.
+- **Fixed**: `FeedbackDataAdmin.changeform_view()` — null guard added after `get_object()` to prevent `AttributeError` when object does not exist.
+- **Fixed**: OK button in result modal now wrapped in `<form method="dialog">` — dialog closes correctly, `close` event fires `location.reload()`.
+- **Fixed**: Buttons missing `type="button"` were inadvertently submitting the admin form — fixed across all modals.
+- **Fixed**: Modals moved to `document.body` via JS — eliminates content flash at page bottom during closing animation.
+- **Fixed**: Import cleanup in `feedbacks/admin.py` — removed unused `display` import, moved `FEEDBACK_COOLDOWN_SECONDS` import to top.
+- **Added**: Full i18n (`{% trans %}`, `{% blocktrans %}`, `gettext_lazy`) across feedback templates and `modeladmin.py` (12 strings); Vietnamese translations updated in `locale/vi`.
+- **Added**: `feedback_cooldown_ms` passed from server via `FeedbackBaseAdmin.render_change_form()` — no more hardcoded 60000ms in template.
+
+### v0.2.42 (2026-03-31)
 **Improve: persist filter/search state in admin changelist + fix Django duplicate filter bug**
 - **Added**: Filter/search state is now persisted via `sessionStorage` across navigation — selecting a filter, navigating to a detail page, then returning restores the exact filter state automatically.
 - **Fixed**: Django bug — `add_preserved_filters()` uses `dict(parse_qsl())` which drops duplicate filter params (e.g. `?chapter__id__exact=29&chapter__id__exact=31` → only `=31` kept after save). Fixed server-side in `ModelAdmin._fix_preserved_filters()` — rebuilds the redirect URL with `parse_qsl()` (preserves all values) when duplicates are detected.

{django_whiteneuron-0.2.42 → django_whiteneuron-0.2.44}/README.md

@@ -11,7 +11,7 @@ A modern Django Admin extension focused on UI/UX, dashboard, feedback, file mana
 
 ## Current Version
 
-- 0.2.42
+- 0.2.44
 
 ## Compatibility
 
@@ -22,7 +22,30 @@ A modern Django Admin extension focused on UI/UX, dashboard, feedback, file mana
 
 ## Changelog
 
-### v0.2.42 (2026-03-31) — latest
+### v0.2.44 (2026-04-02) — latest
+**Fixes & Improvements: Feedback System — Error handling, input limits, i18n lazy evaluation**
+- **Fixed**: `changeform_view` now returns `JsonResponse({"success": True})` after a successful resolve instead of falling through to `super()` with a POST request — prevents a spurious HTTP 403 caused by `has_change_permission = False`.
+- **Fixed**: `note` is read from `request.POST` instead of `request.GET` — prevents HTTP 414 (URI Too Long) when the note is lengthy.
+- **Fixed**: JS `fetch` upgraded to POST + `FormData` with CSRF token; error handling now maps status codes (403/404/500/network) to specific user-facing messages.
+- **Added**: Two-sided character limits — `maxlength` attribute + live counter on client; server-side validation: `note ≤ 500`, `feedback_message ≤ 2000`.
+- **Added**: `get_short_message()` in `FeedbackDataAdmin.list_display` — truncates to 200 words via Django's `Truncator`.
+- **Fixed**: `search_help_text` moved from `__init__` to a `@property` using `format_lazy` — now re-evaluates per request and responds correctly to language switches instead of being frozen at server startup.
+
+### v0.2.43 (2026-04-01)
+**Feature: Feedback System — DaisyUI modals, anti-spam cooldown, i18n, security hardening**
+- **Added**: DaisyUI `<dialog>` modals replace native `prompt()`/`alert()` in both `feedback_change_form.html` (Mark as Resolved flow) and `submit_line.html` (Feedback submission) — smooth animations, no browser dialogs.
+- **Added**: Server-side anti-spam cooldown — 60s per user globally; HTTP 429 with dynamically calculated remaining seconds (`remaining = 60 - elapsed`).
+- **Security**: Replaced `@csrf_exempt` with `@require_POST` in feedback endpoint — CSRF protection fully enforced via `X-CSRFToken` header.
+- **Security**: Auth check moved before body parse; removed redundant `User.objects.get()` in favor of `request.user`.
+- **Fixed**: `FeedbackDataAdmin.changeform_view()` — null guard added after `get_object()` to prevent `AttributeError` when object does not exist.
+- **Fixed**: OK button in result modal now wrapped in `<form method="dialog">` — dialog closes correctly, `close` event fires `location.reload()`.
+- **Fixed**: Buttons missing `type="button"` were inadvertently submitting the admin form — fixed across all modals.
+- **Fixed**: Modals moved to `document.body` via JS — eliminates content flash at page bottom during closing animation.
+- **Fixed**: Import cleanup in `feedbacks/admin.py` — removed unused `display` import, moved `FEEDBACK_COOLDOWN_SECONDS` import to top.
+- **Added**: Full i18n (`{% trans %}`, `{% blocktrans %}`, `gettext_lazy`) across feedback templates and `modeladmin.py` (12 strings); Vietnamese translations updated in `locale/vi`.
+- **Added**: `feedback_cooldown_ms` passed from server via `FeedbackBaseAdmin.render_change_form()` — no more hardcoded 60000ms in template.
+
+### v0.2.42 (2026-03-31)
 **Improve: persist filter/search state in admin changelist + fix Django duplicate filter bug**
 - **Added**: Filter/search state is now persisted via `sessionStorage` across navigation — selecting a filter, navigating to a detail page, then returning restores the exact filter state automatically.
 - **Fixed**: Django bug — `add_preserved_filters()` uses `dict(parse_qsl())` which drops duplicate filter params (e.g. `?chapter__id__exact=29&chapter__id__exact=31` → only `=31` kept after save). Fixed server-side in `ModelAdmin._fix_preserved_filters()` — rebuilds the redirect URL with `parse_qsl()` (preserves all values) when duplicates are detected.

{django_whiteneuron-0.2.42 → django_whiteneuron-0.2.44}/django_whiteneuron.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-whiteneuron
-Version: 0.2.42
+Version: 0.2.44
 Summary: A modern Django Admin extension with enhanced UI/UX, dashboard, feedback, file management, rate limiting, IP blacklisting, and advanced admin integrations built on django-unfold.
 Author-email: White Neuron <anhnt@whiteneuron.com>
 License: MIT License
@@ -94,7 +94,7 @@ A modern Django Admin extension focused on UI/UX, dashboard, feedback, file mana
 
 ## Current Version
 
-- 0.2.42
+- 0.2.44
 
 ## Compatibility
 
@@ -105,7 +105,30 @@ A modern Django Admin extension focused on UI/UX, dashboard, feedback, file mana
 
 ## Changelog
 
-### v0.2.42 (2026-03-31) — latest
+### v0.2.44 (2026-04-02) — latest
+**Fixes & Improvements: Feedback System — Error handling, input limits, i18n lazy evaluation**
+- **Fixed**: `changeform_view` now returns `JsonResponse({"success": True})` after a successful resolve instead of falling through to `super()` with a POST request — prevents a spurious HTTP 403 caused by `has_change_permission = False`.
+- **Fixed**: `note` is read from `request.POST` instead of `request.GET` — prevents HTTP 414 (URI Too Long) when the note is lengthy.
+- **Fixed**: JS `fetch` upgraded to POST + `FormData` with CSRF token; error handling now maps status codes (403/404/500/network) to specific user-facing messages.
+- **Added**: Two-sided character limits — `maxlength` attribute + live counter on client; server-side validation: `note ≤ 500`, `feedback_message ≤ 2000`.
+- **Added**: `get_short_message()` in `FeedbackDataAdmin.list_display` — truncates to 200 words via Django's `Truncator`.
+- **Fixed**: `search_help_text` moved from `__init__` to a `@property` using `format_lazy` — now re-evaluates per request and responds correctly to language switches instead of being frozen at server startup.
+
+### v0.2.43 (2026-04-01)
+**Feature: Feedback System — DaisyUI modals, anti-spam cooldown, i18n, security hardening**
+- **Added**: DaisyUI `<dialog>` modals replace native `prompt()`/`alert()` in both `feedback_change_form.html` (Mark as Resolved flow) and `submit_line.html` (Feedback submission) — smooth animations, no browser dialogs.
+- **Added**: Server-side anti-spam cooldown — 60s per user globally; HTTP 429 with dynamically calculated remaining seconds (`remaining = 60 - elapsed`).
+- **Security**: Replaced `@csrf_exempt` with `@require_POST` in feedback endpoint — CSRF protection fully enforced via `X-CSRFToken` header.
+- **Security**: Auth check moved before body parse; removed redundant `User.objects.get()` in favor of `request.user`.
+- **Fixed**: `FeedbackDataAdmin.changeform_view()` — null guard added after `get_object()` to prevent `AttributeError` when object does not exist.
+- **Fixed**: OK button in result modal now wrapped in `<form method="dialog">` — dialog closes correctly, `close` event fires `location.reload()`.
+- **Fixed**: Buttons missing `type="button"` were inadvertently submitting the admin form — fixed across all modals.
+- **Fixed**: Modals moved to `document.body` via JS — eliminates content flash at page bottom during closing animation.
+- **Fixed**: Import cleanup in `feedbacks/admin.py` — removed unused `display` import, moved `FEEDBACK_COOLDOWN_SECONDS` import to top.
+- **Added**: Full i18n (`{% trans %}`, `{% blocktrans %}`, `gettext_lazy`) across feedback templates and `modeladmin.py` (12 strings); Vietnamese translations updated in `locale/vi`.
+- **Added**: `feedback_cooldown_ms` passed from server via `FeedbackBaseAdmin.render_change_form()` — no more hardcoded 60000ms in template.
+
+### v0.2.42 (2026-03-31)
 **Improve: persist filter/search state in admin changelist + fix Django duplicate filter bug**
 - **Added**: Filter/search state is now persisted via `sessionStorage` across navigation — selecting a filter, navigating to a detail page, then returning restores the exact filter state automatically.
 - **Fixed**: Django bug — `add_preserved_filters()` uses `dict(parse_qsl())` which drops duplicate filter params (e.g. `?chapter__id__exact=29&chapter__id__exact=31` → only `=31` kept after save). Fixed server-side in `ModelAdmin._fix_preserved_filters()` — rebuilds the redirect URL with `parse_qsl()` (preserves all values) when duplicates are detected.

{django_whiteneuron-0.2.42 → django_whiteneuron-0.2.44}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "django-whiteneuron"
-version = "0.2.42"
+version = "0.2.44"
 description = "A modern Django Admin extension with enhanced UI/UX, dashboard, feedback, file management, rate limiting, IP blacklisting, and advanced admin integrations built on django-unfold."
 authors = [
     {name = "White Neuron", email = "anhnt@whiteneuron.com"}

{django_whiteneuron-0.2.42 → django_whiteneuron-0.2.44}/whiteneuron/base/modeladmin.py

@@ -24,6 +24,9 @@ from .filters import FieldSelectionFilter
 from django.urls import path
 from django.shortcuts import render
 
+from django.utils.translation import gettext_lazy as _
+from django.utils.text import format_lazy
+
 from unfold.contrib.filters.admin import (
     AutocompleteSelectFilter,
     AutocompleteSelectMultipleFilter,
@@ -78,9 +81,13 @@ class ModelAdmin(UnfoldAdmin):
 
     default_toggle_sidebar= True
 
+    @property
+    def search_help_text(self):
+        fields = ', '.join([str(get_verbose_name_field(self.model, f)) for f in self.search_fields])
+        return format_lazy(_('Search by {fields}'), fields=fields)
+
     def __init__(self, model, admin_site):
         super().__init__(model, admin_site)
-        self.search_help_text= f'Search by {", ".join([get_verbose_name_field(model, f) for f in self.search_fields])}'
 
         if self.text_field_widget == 'ckeditor':
             self.formfield_overrides[models.TextField]["widget"]= CKEditor5Widget(
@@ -138,8 +145,8 @@ class ModelAdmin(UnfoldAdmin):
 
     def soft_delete(self, cl, request, queryset):
         for obj in queryset:
-            title= f"{obj._meta.verbose_name} \"{obj}\" has been soft-deleted by user \"{request.user}\""
-            content_html= f"{obj._meta.verbose_name} \"{obj}\" has been soft-deleted by user \"{request.user}\""
+            title= _('%(name)s "%(obj)s" has been soft-deleted by user "%(user)s"') % {'name': obj._meta.verbose_name, 'obj': obj, 'user': request.user}
+            content_html= _('%(name)s "%(obj)s" has been soft-deleted by user "%(user)s"') % {'name': obj._meta.verbose_name, 'obj': obj, 'user': request.user}
             obj.delete()
             # send notification to superuser when delete successfully
             for user in User.objects.filter(is_superuser= True):
@@ -148,12 +155,12 @@ class ModelAdmin(UnfoldAdmin):
                                             flag= 'danger',
                                             action= 'delete',
                                             content= content_html)
-    soft_delete.short_description = 'Delete selected records'
+    soft_delete.short_description = _('Delete selected records')
 
     def hard_delete(self, cl, request, queryset):
         for obj in queryset:
-            title= f"{obj._meta.verbose_name} \"{obj}\" has been hard-deleted by user \"{request.user}\""
-            content_html= f"{obj._meta.verbose_name} \"{obj}\" has been hard-deleted by user \"{request.user}\""
+            title= _('%(name)s "%(obj)s" has been hard-deleted by user "%(user)s"') % {'name': obj._meta.verbose_name, 'obj': obj, 'user': request.user}
+            content_html= _('%(name)s "%(obj)s" has been hard-deleted by user "%(user)s"') % {'name': obj._meta.verbose_name, 'obj': obj, 'user': request.user}
             if hasattr(obj, 'hard_delete'):
                 obj.hard_delete()
             else:
@@ -165,12 +172,12 @@ class ModelAdmin(UnfoldAdmin):
                                             flag= 'danger',
                                             action= 'delete',
                                             content= content_html)
-    hard_delete.short_description = 'Hard delete selected records'
+    hard_delete.short_description = _('Hard delete selected records')
 
     def restore(self, cl, request, queryset):
         for obj in queryset:
-            title= f"{obj._meta.verbose_name} \"{obj}\" has been restored by user \"{request.user}\""
-            content_html= f"{obj._meta.verbose_name} \"{obj}\" has been restored by user \"{request.user}\""
+            title= _('%(name)s "%(obj)s" has been restored by user "%(user)s"') % {'name': obj._meta.verbose_name, 'obj': obj, 'user': request.user}
+            content_html= _('%(name)s "%(obj)s" has been restored by user "%(user)s"') % {'name': obj._meta.verbose_name, 'obj': obj, 'user': request.user}
             obj.restore(request)
             # send notification to superuser when delete successfully
             for user in User.objects.filter(is_superuser= True):
@@ -179,7 +186,7 @@ class ModelAdmin(UnfoldAdmin):
                                             flag= 'info',
                                             action= 'restore',
                                             content= content_html)
-    restore.short_description = 'Restore selected records'
+    restore.short_description = _('Restore selected records')
 
     def get_queryset(self, request: HttpRequest) -> QuerySet[Any]:
         if request.user.is_superuser and request.user.show_softdelete:
@@ -188,8 +195,8 @@ class ModelAdmin(UnfoldAdmin):
         return self.model.objects.all()
 
     def delete_model(self, request, obj):
-        title= f"{obj._meta.verbose_name} \"{obj}\" has been soft-deleted by user \"{request.user}\""
-        content_html= f"{obj._meta.verbose_name} \"{obj}\" has been soft-deleted by user \"{request.user}\""
+        title= _('%(name)s "%(obj)s" has been soft-deleted by user "%(user)s"') % {'name': obj._meta.verbose_name, 'obj': obj, 'user': request.user}
+        content_html= _('%(name)s "%(obj)s" has been soft-deleted by user "%(user)s"') % {'name': obj._meta.verbose_name, 'obj': obj, 'user': request.user}
         super().delete_model(request, obj)
         # send notification to superuser when delete successfully
         for user in User.objects.filter(is_superuser= True):
@@ -394,7 +401,7 @@ class ModelAdmin(UnfoldAdmin):
                 meta_fields.remove('updated_at')
                 meta_fields.remove('updated_by')
                 meta_fields.append(('updated_at', 'updated_by'))
-            fieldsets.append(('Meta', {'fields': meta_fields, 'classes': ["tab"]}))
+            fieldsets.append((_('Meta'), {'fields': meta_fields, 'classes': ["collapse"]}))
         return fieldsets
     
     def buttons(self, obj):
@@ -414,15 +421,15 @@ class ModelAdmin(UnfoldAdmin):
         path_delete= reverse_lazy(path + '_delete', args=[obj.pk])
         c= 0
         if self.has_change_permission(self.request, obj):
-            button_edit = f'<a class="btn-edit col-span-1" href="{path_change}"> <img src="{svg_url_edit}" alt="Sửa" style="width: {width}px; height: {height}px;"></a>'
+            button_edit = f'<a class="btn-edit col-span-1" href="{path_change}"> <img src="{svg_url_edit}" alt="{_("Edit")}" style="width: {width}px; height: {height}px;"></a>'
             c+= 1
         else:
-            button_view = f'<a class="btn-view col-span-1" href="{path_change}"> <img src="{svg_url_view}" alt="Xem" style="width: {width}px; height: {height}px;"></a>'
+            button_view = f'<a class="btn-view col-span-1" href="{path_change}"> <img src="{svg_url_view}" alt="{_("View")}" style="width: {width}px; height: {height}px;"></a>'
             c+= 1
 
         if self.has_delete_permission(self.request, obj):
             c+= 1
-            button_delete = f'<a class="btn-delete btn-danger col-span-1" href="{path_delete}"> <img src="{svg_url_delete}" alt="Xóa" style="width: {width}px; height: {height}px;"></a>'
+            button_delete = f'<a class="btn-delete btn-danger col-span-1" href="{path_delete}"> <img src="{svg_url_delete}" alt="{_("Delete")}" style="width: {width}px; height: {height}px;"></a>'
 
         return mark_safe(f'''
                          <div id="action_buttoms_{obj.pk}" class="action_buttoms grid gap-1 grid-cols-{c}" style="width: {33*c}px;">{button_view} {button_edit} {button_delete} </div> 

{django_whiteneuron-0.2.42 → django_whiteneuron-0.2.44}/whiteneuron/base/utils.py

@@ -15,7 +15,7 @@ def timeit(func):
 from django.utils import timezone
 from django.core.exceptions import FieldDoesNotExist
 
-def base_badge_callback(request, model):
+def base_badge_callback(request, model, filter_kwargs=None):
     today = timezone.localtime().replace(hour=0, minute=0, second=0, microsecond=0)
 
     # try:
@@ -42,7 +42,11 @@ def base_badge_callback(request, model):
 
     c = getattr(model, 'objects_all', model.objects).filter(
       updated_at__gte=today,
-    ).count()
+    )
+    if filter_kwargs:
+        c = c.filter(**filter_kwargs).count()
+    else:        
+        c = c.count()
     return c
 
 

{django_whiteneuron-0.2.42 → django_whiteneuron-0.2.44}/whiteneuron/feedbacks/admin.py

@@ -1,11 +1,13 @@
 from django.contrib import admin, messages
+from django.http import JsonResponse
+from django.urls import reverse
+from django.utils.html import format_html
+from django.utils.text import Truncator
 from django.utils.translation import gettext_lazy as _
-from unfold.decorators import display
 
 from whiteneuron.base.admin import base_admin_site, ModelAdmin
 from .models import FeedbackData
-
-from django.urls import reverse
+from .urls import FEEDBACK_COOLDOWN_SECONDS
 
 from whiteneuron.notification.models import Notification
 
@@ -18,7 +20,7 @@ class FeedbackDataAdmin(ModelAdmin):
         'user',
         'content_type',
         'get_related_object_link',  # Hiển thị link đến object gốc
-        'message',
+        'get_short_message',
         'is_resolved',
         'created_at',
     )
@@ -26,26 +28,39 @@ class FeedbackDataAdmin(ModelAdmin):
     search_fields = ('message', 'user__username', 'content_type__model')
 
     fieldsets = (
-        ('Feedback Data', {
-            'fields': ('user', ('content_type', 'object_id'), ('get_related_object_link', 'field'), 'message')
+        (_('Feedback Data'), {
+            # 'fields': ('user', ('content_type', 'object_id'), ('get_related_object_link', 'field'), 'message')
+            'fields': ('user', ('content_type', 'object_id'), 'get_related_object_link', 'message')
         }),
-        ('Status', {
+        (_('Status'), {
             'fields': ('is_resolved', 'note')
         })
     )
 
     readonly_fields = ('get_related_object_link',)  # Chỉ hiển thị link, không cho sửa
 
+    def get_queryset(self, request):
+        qs = super().get_queryset(request)
+        if request.user.is_superuser:
+            return qs
+        
+        # Người liên quan có thể xem feedback        
+        return qs.filter(user=request.user) 
+    
+    def get_short_message(self, obj):
+        return Truncator(obj.message).words(200)
+    get_short_message.short_description = _('Message')
+
     def get_related_object_link(self, obj):
         """Hiển thị link đến object gốc"""
         if obj.content_object:
             admin_url = reverse(
-                f'admin:{obj.content_type.app_label}_{obj.content_type.model}_change', 
+                f'admin:{obj.content_type.app_label}_{obj.content_type.model}_change',
                 args=[obj.object_id]
             )
-            return format_html(f'<a href="{admin_url}" target="_blank">{obj.content_object}</a>')
+            return format_html('<a href="{}" target="_blank">{}</a>', admin_url, obj.content_object)
         return "-"
-    get_related_object_link.short_description = "Related Object"  # Tiêu đề trong Admin
+    get_related_object_link.short_description = _("Related Object")  # Tiêu đề trong Admin
 
     # Định nghĩa action để đánh dấu đã xử lý
     actions = ['mark_as_resolved']
@@ -83,13 +98,16 @@ class FeedbackDataAdmin(ModelAdmin):
         if request.GET.get('resolved') == '1' and object_id:
             # chỉ cho phép superuser thực hiện
             if not request.user.is_superuser:
-                self.message_user(request, _("Only superuser can mark feedback as resolved"), messages.ERROR)
-                return super().changeform_view(request, object_id, form_url, extra_context)
+                return JsonResponse({"success": False, "message": str(_("Only superuser can mark feedback as resolved"))}, status=403)
             
             # note
-            note= request.GET.get('note', '')
+            note= request.POST.get('note', '')
+            if len(note) > 500:
+                return JsonResponse({"success": False, "message": str(_("Note must not exceed 500 characters."))}, status=400)
 
             obj = self.get_object(request, object_id)
+            if obj is None:
+                return JsonResponse({"success": False, "message": str(_("Feedback not found."))}, status=404)
             obj.is_resolved = True
             obj.note = note
             obj.save()
@@ -98,30 +116,25 @@ class FeedbackDataAdmin(ModelAdmin):
             noti= Notification(
                 user= obj.user,
                 title= _("Feedback resolved"),
-                content= f"""
-                    <p>Your feedback has been resolved.</p>
-                    <p>Object: {self.get_related_object_link(obj)}</p>
-                    <p>Note: {note}</p>
-                """,
+                content= format_html(
+                    '<p>{}</p><p>{}: {}</p><p>{}: {}</p>',
+                    _("Your feedback has been resolved."),
+                    _("Object"), self.get_related_object_link(obj),
+                    _("Note"), note,
+                ),
                 action='update',
                 flag= 'success',
             )
             noti.save()
 
-            # reload và thông báo
-            self.message_user(request, _("Feedback marked as resolved"), messages.SUCCESS)
+            return JsonResponse({"success": True})
 
         return super().changeform_view(request, object_id, form_url, extra_context)
 
 # FeedBack base admin
 # Cho phép các model khác kế thừa để gọi
-from django.utils.html import format_html
 class FeedbackBaseAdmin(ModelAdmin):
     def render_change_form(self, request, context, *args, **kwargs):
-        # Thêm show_feedback = True vào context để hiển thị feedbacks
         context['show_feedback'] = True
+        context['feedback_cooldown_ms'] = FEEDBACK_COOLDOWN_SECONDS * 1000
         return super().render_change_form(request, context, *args, **kwargs)
-
-
-        
-    

django_whiteneuron-0.2.44/whiteneuron/feedbacks/urls.py

@@ -0,0 +1,81 @@
+import json
+import logging
+from django.urls import path
+from django.http import JsonResponse
+from django.views.decorators.http import require_POST
+from django.contrib.contenttypes.models import ContentType
+from django.utils import timezone
+from django.utils.translation import gettext as _
+from datetime import timedelta
+from whiteneuron.feedbacks.models import FeedbackData
+
+FEEDBACK_COOLDOWN_SECONDS = 60
+
+logger = logging.getLogger(__name__)
+
+@require_POST
+def receive_feedback(request):
+    if not request.user.is_authenticated:
+        return JsonResponse({"success": False, "message": _("User is not authenticated")}, status=403)
+
+    try:
+        # Đọc dữ liệu từ request
+        body_unicode = request.body.decode("utf-8")
+
+        data = json.loads(body_unicode)
+        object_id = data.get("object_id")
+        field = data.get("field")
+        feedback_message = data.get("feedback_message")
+        model_name = data.get("model_name")
+        app_label = data.get("app_label")
+
+        # Kiểm tra dữ liệu bắt buộc
+        if not object_id or not feedback_message or not model_name or not app_label:
+            return JsonResponse({"success": False, "message": _("Missing required fields")}, status=400)
+
+        if len(feedback_message) > 2000:
+            return JsonResponse({"success": False, "message": _("Feedback message must not exceed 2000 characters.")}, status=400)
+
+        # Lấy ContentType
+        try:
+            content_type = ContentType.objects.get(model=model_name, app_label=app_label)
+        except ContentType.DoesNotExist:
+            return JsonResponse({"success": False, "message": _("Invalid model or app_label")}, status=400)
+
+        # Kiểm tra cooldown chống spam — per user, không phân biệt đối tượng
+        cooldown_since = timezone.now() - timedelta(seconds=FEEDBACK_COOLDOWN_SECONDS)
+        last_feedback = FeedbackData.objects.filter(
+            user=request.user,
+            created_at__gte=cooldown_since,
+        ).order_by('-created_at').first()
+        if last_feedback:
+            remaining = FEEDBACK_COOLDOWN_SECONDS - int((timezone.now() - last_feedback.created_at).total_seconds())
+            return JsonResponse(
+                {"success": False, "message": _("Please wait %(seconds)d seconds before submitting another feedback.") % {"seconds": max(remaining, 1)}},
+                status=429,
+            )
+
+        # Tạo feedback mới
+        feedback = FeedbackData(
+            user=request.user,
+            content_type=content_type,
+            object_id=object_id,
+            field=field,
+            message=feedback_message,
+        )
+
+        feedback.save()
+
+        logger.info("Feedback saved: %s", feedback)
+        return JsonResponse({"success": True, "message": _("Feedback saved successfully")})
+
+    except json.JSONDecodeError:
+        logger.error("Invalid JSON format in feedback submission")
+        return JsonResponse({"success": False, "message": _("Invalid JSON format")}, status=400)
+    except Exception as e:
+        logger.error("Error saving feedback: %s", e, exc_info=True)
+        return JsonResponse({"success": False, "message": _("An unexpected error occurred. Please try again.")}, status=500)
+
+urlpatterns = [
+    path("feedback/", receive_feedback, name="feedback_endpoint"),
+]

django_whiteneuron-0.2.44/whiteneuron/feedbacks/utils.py

@@ -0,0 +1,10 @@
+from whiteneuron.base.utils import base_badge_callback
+from .models import FeedbackData
+
+def feedback_data_badge_callback(request):
+    # Lọc feedback theo user hiện tại
+    if request.user.is_superuser:
+        filter_kwargs = None  # Superuser xem tất cả feedback
+    else:
+        filter_kwargs = {'user': request.user}
+    return base_badge_callback(request, FeedbackData, filter_kwargs)