openwisp-controller 1.2.3__tar.gz → 1.3.1__tar.gz

{openwisp_controller-1.2.3 → openwisp_controller-1.3.1}/CHANGES.rst

@@ -1,6 +1,169 @@
 Changelog
 =========
 
+Version 1.3.1 [2026-10-15]
+--------------------------
+
+Security
+~~~~~~~~
+
+- Fixed insecure multi-tenancy boundary in location REST API
+
+  Fixed a **security issue** that allowed organization managers to link
+  locations and floorplans belonging to other organizations to their
+  devices by submitting known object IDs.
+
+  The API now resolves related objects only from organizations managed by
+  the requesting user and validates the organization of all
+  device-location relationships. Device lists for a location are scoped to
+  managed organizations and no longer expose device keys.
+
+  Nested location and floorplan writes are validated before being saved
+  and run in a database transaction, preventing rejected requests from
+  leaving related database objects or files behind.
+
+  Advisory: **GHSA-39c4-xj33-j8j3**.
+
+- Fixed XSS vulnerabilities in device and command admin UI
+
+  Fixed cross-site scripting (XSS) vulnerabilities caused by improper
+  escaping of user-controlled data in the following admin pages:
+
+  - Device and device group forms (template names).
+  - Device pages (command inputs, outputs, and management IP).
+  - Subnet administration (device names and links).
+
+  These vulnerabilities could allow attackers to execute malicious
+  JavaScript in an administrator's browser.
+
+  Advisory: **GHSA-4f2x-pxjx-h8m3**.
+
+Bugfixes
+~~~~~~~~
+
+- Fixed loss of data in PATCH requests to device location endpoint `#1510
+  <https://github.com/openwisp/openwisp-controller/issues/1510>`_
+
+  Sending `PATCH` requests to the device location endpoint
+  (`/api/v1/controller/device/{id}/location/`) now doesn't set `location`
+  and `floorplan` to `NULL` when they are not included in the request
+  body.
+
+Changes
+~~~~~~~
+
+- Added IP address search to DeviceAdmin
+
+  Enabled searches by last and management IP addresses.
+
+Version 1.3.0 [2026-09-03]
+--------------------------
+
+Features
+~~~~~~~~
+
+- Added `WHOIS lookup and geographic location estimation
+  <https://github.com/openwisp/openwisp-controller/issues/1034>`_ for
+  devices, including WHOIS details in the admin UI, automatic refresh of
+  stale WHOIS data, estimated-location notifications and warnings, and
+  admin and API filters for estimated locations.
+- Added `WebSocket support for broadcasting all location updates
+  <https://github.com/openwisp/openwisp-controller/issues/1157>`_.
+- Added an `API endpoint for retrieving indoor device coordinates
+  <https://github.com/openwisp/openwisp-controller/issues/828>`_ for a
+  location.
+- Added `location and floorplan filters to the device list API
+  <https://github.com/openwisp/openwisp-controller/issues/1158>`_,
+  allowing searches by location name and filtering by location or
+  floorplan UUID.
+- Added `generic cache invalidation for configuration models
+  <https://github.com/openwisp/openwisp-controller/issues/1095>`_. Models
+  can declare cache dependencies using ``CacheDependency``, and the new
+  ``print_cache_dependencies`` management command can be used to inspect
+  the dependency graph.
+- Added `notes to configuration templates
+  <https://github.com/openwisp/openwisp-controller/issues/1412>`_.
+- Allowed devices to update their name during re-registration.
+
+Changes
+~~~~~~~
+
+Other changes
++++++++++++++
+
+- Enforced the `deactivated device state across OpenWISP Controller
+  <https://github.com/openwisp/openwisp-controller/issues/1338>`_.
+  Deactivated devices can no longer register, receive configuration
+  updates, run remote commands, or receive automatically assigned
+  templates. Cleanup and security operations continue to work normally.
+- Added `VPN subnet and IP address details to the REST API
+  <https://github.com/openwisp/openwisp-controller/issues/1003>`_.
+- Allowed deleting organizations containing active devices while
+  displaying a warning about the active devices that will be affected.
+- Replaced the third-party ``jsonfield`` implementation with Django's
+  built-in ``JSONField`` `#1061
+  <https://github.com/openwisp/openwisp-controller/issues/1061>`_,
+  including migration handling for databases upgraded from older OpenWISP
+  Controller versions.
+- Changed VPN synchronization errors and recovery events to use
+  ``generic_message`` notifications `#1049
+  <https://github.com/openwisp/openwisp-controller/issues/1049>`_.
+- Improved command status visibility in the admin interface by
+  highlighting statuses with different colors `#812
+  <https://github.com/openwisp/openwisp-controller/issues/812>`_.
+
+Dependencies
+++++++++++++
+
+- Bumped ``django-reversion`` from ``~=6.0.0`` to `~=6.3.0
+  <https://github.com/etianen/django-reversion/blob/v6.3.0/CHANGELOG.rst>`_.
+- Bumped ``netjsonconfig`` from ``~=1.2.0`` to `~=1.3.0
+  <https://github.com/openwisp/netjsonconfig/blob/master/CHANGES.rst>`__.
+- Bumped ``django-x509`` from ``~=1.3.0`` to `~=1.4.0
+  <https://github.com/openwisp/django-x509/blob/master/CHANGES.rst>`_.
+- Bumped ``django-loci`` from ``~=1.2.0`` to `~=1.3.0
+  <https://github.com/openwisp/django-loci/blob/master/CHANGES.rst>`__.
+- Bumped ``django-flat-json-widget`` from ``~=0.4.0`` to `~=0.5.0
+  <https://github.com/openwisp/django-flat-json-widget/blob/master/CHANGES.rst>`_.
+- Bumped ``openwisp-users`` from ``~=1.2.0`` to `~=1.3.0
+  <https://github.com/openwisp/openwisp-users/blob/master/CHANGES.rst>`__.
+- Bumped ``openwisp-utils[celery,channels]`` from ``~=1.2.0`` to `~=1.3.0
+  <https://github.com/openwisp/openwisp-utils/blob/master/CHANGES.rst>`__.
+- Bumped ``openwisp-notifications`` from ``~=1.2.0`` to `~=1.3.0
+  <https://github.com/openwisp/openwisp-notifications/blob/master/CHANGES.rst>`__.
+- Bumped ``openwisp-ipam`` from ``~=1.2.0`` to `~=1.3.1
+  <https://github.com/openwisp/openwisp-ipam/blob/master/CHANGES.rst>`_.
+- Bumped ``djangorestframework-gis`` from ``~=1.2.0`` to `~=1.3.0
+  <https://github.com/openwisp/django-rest-framework-gis/blob/master/CHANGES.rst>`__.
+- Bumped ``paramiko`` from ``~=4.0.0`` to `~=5.0.0
+  <https://www.paramiko.org/changelog.html>`_.
+- Bumped ``scp`` from ``~=0.15.0`` to `~=0.16.1
+  <https://github.com/jbardin/scp.py/releases/tag/v0.16.1>`_.
+- Bumped ``django-import-export`` from ``~=4.3.10`` to `~=4.4.1
+  <https://django-import-export.readthedocs.io/en/latest/changelog.html>`_.
+- Added `geoip2>=5.3.0,<6.0.0
+  <https://github.com/maxmind/GeoIP2-python/releases/tag/v5.3.0>`_.
+- Dropped support for Django ``4.2``.
+- Dropped support for Python ``3.9``.
+
+Bugfixes
+~~~~~~~~
+
+- Fixed `subnet-division rules allocating addresses already in use
+  <https://github.com/openwisp/openwisp-controller/issues/1464>`_ by
+  respecting existing child prefixes and pre-allocated IP addresses.
+- Fixed background command and connection operations potentially restoring
+  objects that had been deleted concurrently or causing foreign key
+  errors.
+- Fixed VPN client synchronization when switching VPN templates,
+  preventing inconsistent client state during repeated template updates.
+- Fixed SSH connections remaining open when ``update_config()`` failed.
+- Fixed `malformed UUID URLs returning HTTP 500 instead of HTTP 404
+  <https://github.com/openwisp/openwisp-controller/issues/682>`_.
+- Fixed the Device admin delete confirmation page when OpenWISP Controller
+  is extended by downstream applications.
+- Fixed a typo in the ``update_strategy`` validation error message.
+
 Version 1.2.3 [2026-04-09]
 --------------------------
 

{openwisp_controller-1.2.3/openwisp_controller.egg-info → openwisp_controller-1.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openwisp-controller
-Version: 1.2.3
+Version: 1.3.1
 Summary: OpenWISP Controller
 Home-page: http://openwisp.org
 Download-URL: https://github.com/openwisp/openwisp-controller/releases
@@ -20,23 +20,24 @@ Classifier: Framework :: Django
 Classifier: Programming Language :: Python :: 3
 License-File: LICENSE
 Requires-Dist: django-sortedm2m~=4.0.0
-Requires-Dist: django-reversion~=6.0.0
+Requires-Dist: django-reversion~=6.3.0
 Requires-Dist: django-taggit~=6.1.0
-Requires-Dist: netjsonconfig~=1.2.0
-Requires-Dist: django-x509~=1.3.0
-Requires-Dist: django-loci~=1.2.0
-Requires-Dist: django-flat-json-widget~=0.4.0
-Requires-Dist: openwisp-users~=1.2.0
-Requires-Dist: openwisp-utils[celery,channels]~=1.2.0
-Requires-Dist: openwisp-notifications~=1.2.0
-Requires-Dist: openwisp-ipam~=1.2.0
-Requires-Dist: djangorestframework-gis~=1.2.0
-Requires-Dist: paramiko~=4.0.0
-Requires-Dist: scp~=0.15.0
+Requires-Dist: netjsonconfig~=1.3.0
+Requires-Dist: django-x509~=1.4.0
+Requires-Dist: django-loci~=1.3.0
+Requires-Dist: django-flat-json-widget~=0.5.0
+Requires-Dist: openwisp-users~=1.3.0
+Requires-Dist: openwisp-utils[celery,channels]~=1.3.0
+Requires-Dist: openwisp-notifications~=1.3.0
+Requires-Dist: openwisp-ipam~=1.3.1
+Requires-Dist: djangorestframework-gis~=1.3.0
+Requires-Dist: paramiko~=5.0.0
+Requires-Dist: scp~=0.16.1
 Requires-Dist: django-cache-memoize~=0.2.1
 Requires-Dist: shortuuid~=1.0.13
 Requires-Dist: netaddr~=1.3.0
-Requires-Dist: django-import-export~=4.3.10
+Requires-Dist: django-import-export~=4.4.1
+Requires-Dist: geoip2<6.0.0,>=5.3.0
 Dynamic: author
 Dynamic: author-email
 Dynamic: classifier

{openwisp_controller-1.2.3 → openwisp_controller-1.3.1}/openwisp_controller/__init__.py

@@ -1,4 +1,4 @@
-VERSION = (1, 2, 3, "final")
+VERSION = (1, 3, 1, "final")
 __version__ = VERSION  # alias
 
 

{openwisp_controller-1.2.3 → openwisp_controller-1.3.1}/openwisp_controller/config/admin.py

@@ -15,12 +15,14 @@ from django.core.exceptions import (
     ObjectDoesNotExist,
     ValidationError,
 )
+from django.db import models
+from django.db.models.functions import Cast
 from django.http import Http404, HttpResponse, HttpResponseRedirect, JsonResponse
 from django.http.response import HttpResponseForbidden
 from django.shortcuts import get_object_or_404
 from django.template.loader import get_template
 from django.template.response import TemplateResponse
-from django.urls import path, re_path, reverse
+from django.urls import NoReverseMatch, path, reverse
 from django.utils.html import format_html, mark_safe
 from django.utils.translation import gettext_lazy as _
 from django.utils.translation import ngettext_lazy
@@ -31,12 +33,14 @@ from openwisp_ipam.filters import SubnetFilter
 from swapper import load_model
 
 from openwisp_controller.config.views import get_default_values, get_relevant_templates
+from openwisp_controller.config.whois.utils import get_whois_info
 from openwisp_users.admin import OrganizationAdmin
 from openwisp_users.multitenancy import MultitenantOrgFilter
 from openwisp_utils.admin import (
     AlwaysHasChangedMixin,
+    BlockDeleteAllowCascadeMixin,
+    CopyableFieldsAdmin,
     TimeReadonlyAdminMixin,
-    UUIDAdmin,
 )
 
 from ..admin import MultitenantAdminMixin
@@ -49,6 +53,7 @@ from .widgets import DeviceGroupJsonSchemaWidget, JsonSchemaWidget
 
 logger = logging.getLogger(__name__)
 prefix = "config/"
+whois_prefix = "whois/"
 Config = load_model("config", "Config")
 Device = load_model("config", "Device")
 DeviceGroup = load_model("config", "DeviceGroup")
@@ -111,7 +116,7 @@ class BaseConfigAdmin(BaseAdmin):
 
     class Media:
         css = {"all": (f"{prefix}css/admin.css",)}
-        js = list(UUIDAdmin.Media.js) + [
+        js = list(CopyableFieldsAdmin.Media.js) + [
             f"{prefix}js/{file_}"
             for file_ in ("preview.js", "unsaved_changes.js", "switcher.js")
         ]
@@ -137,16 +142,15 @@ class BaseConfigAdmin(BaseAdmin):
         if not issubclass(self.model, AbstractVpn):
             ctx["CONFIG_BACKEND_FIELD_SHOWN"] = app_settings.CONFIG_BACKEND_FIELD_SHOWN
         if pk:
-            ctx["download_url"] = reverse("{0}_download".format(prefix), args=[pk])
             try:
+                download_url = reverse("{0}_download".format(prefix), args=[pk])
                 has_config = True
                 if self.model.__name__ == "Device":
                     has_config = self.model.objects.get(pk=pk)._has_config()
-            except (ObjectDoesNotExist, ValidationError):
+            except (ObjectDoesNotExist, ValidationError, NoReverseMatch):
                 raise Http404()
             else:
-                if not has_config:
-                    ctx["download_url"] = None
+                ctx["download_url"] = download_url if has_config else None
         return ctx
 
     def add_view(self, request, form_url="", extra_context=None):
@@ -167,8 +171,8 @@ class BaseConfigAdmin(BaseAdmin):
         options = getattr(self.model, "_meta")
         url_prefix = "{0}_{1}".format(options.app_label, options.model_name)
         return [
-            re_path(
-                r"^download/(?P<pk>[^/]+)/$",
+            path(
+                "download/<uuid_any:pk>/",
                 self.admin_site.admin_view(self.download_view),
                 name="{0}_download".format(url_prefix),
             ),
@@ -177,8 +181,8 @@ class BaseConfigAdmin(BaseAdmin):
                 self.admin_site.admin_view(self.preview_view),
                 name="{0}_preview".format(url_prefix),
             ),
-            re_path(
-                r"^(?P<pk>[^/]+)/context\.json$",
+            path(
+                "<uuid_any:pk>/context.json",
                 self.admin_site.admin_view(self.context_view),
                 name="{0}_context".format(url_prefix),
             ),
@@ -215,6 +219,15 @@ class BaseConfigAdmin(BaseAdmin):
                 key = "{relation}_id".format(relation=key)
                 # pass non-empty string or None
                 kwargs[key] = value or None
+            # parse JSON strings for JSONField fields
+            elif isinstance(field, models.JSONField) and isinstance(value, str):
+                if not value:
+                    kwargs[key] = None
+                else:
+                    try:
+                        kwargs[key] = json.loads(value)
+                    except json.JSONDecodeError:
+                        kwargs[key] = value
             # put regular field values in kwargs dict
             else:
                 kwargs[key] = value
@@ -498,11 +511,12 @@ class ChangeDeviceGroupForm(forms.Form):
         )
 
 
-class DeviceAdmin(MultitenantAdminMixin, BaseConfigAdmin, UUIDAdmin):
+class DeviceAdmin(MultitenantAdminMixin, BaseConfigAdmin, CopyableFieldsAdmin):
     change_form_template = "admin/config/device/change_form.html"
     delete_selected_confirmation_template = (
         "admin/config/device/delete_selected_confirmation.html"
     )
+    delete_confirmation_template = "admin/config/device/delete_confirmation.html"
     list_display = [
         "name",
         "backend",
@@ -528,6 +542,8 @@ class DeviceAdmin(MultitenantAdminMixin, BaseConfigAdmin, UUIDAdmin):
         "model",
         "os",
         "system",
+        "last_ip",
+        "management_ip",
         "devicelocation__location__address",
     ]
     readonly_fields = ["last_ip", "uuid"]
@@ -548,6 +564,7 @@ class DeviceAdmin(MultitenantAdminMixin, BaseConfigAdmin, UUIDAdmin):
         "created",
         "modified",
     ]
+    copyable_fields = ["uuid"]
     inlines = [ConfigInline]
     conditional_inlines = []
     actions = [
@@ -569,12 +586,21 @@ class DeviceAdmin(MultitenantAdminMixin, BaseConfigAdmin, UUIDAdmin):
         fields.insert(0, "hardware_id")
     list_select_related = ("config", "organization")
 
-    class Media(BaseConfigAdmin.Media):
+    # overriding media property to allow testing in isolation
+    # as class Media is evaluated at import time making the
+    # settings not overridable in tests
+    @property
+    def media(self):
         js = BaseConfigAdmin.Media.js + [
             f"{prefix}js/tabs.js",
             f"{prefix}js/management_ip.js",
             f"{prefix}js/relevant_templates.js",
         ]
+        css = BaseConfigAdmin.Media.css["all"]
+        if app_settings.WHOIS_CONFIGURED:
+            js.append(f"{whois_prefix}js/whois.js")
+            css += (f"{whois_prefix}css/whois.css",)
+        return super().media + forms.Media(js=js, css={"all": css})
 
     def has_change_permission(self, request, obj=None):
         perm = super().has_change_permission(request)
@@ -586,8 +612,70 @@ class DeviceAdmin(MultitenantAdminMixin, BaseConfigAdmin, UUIDAdmin):
         perm = super().has_delete_permission(request)
         if not obj:
             return perm
+        if BlockDeleteAllowCascadeMixin.is_admin_cascade_delete_request(self, request):
+            self._add_active_device_delete_warning(request, obj)
+            return perm
         return perm and obj.is_deactivated()
 
+    def _add_active_device_delete_warning(self, request, obj):
+        if getattr(request, "_active_device_delete_warning_checked", False):
+            return
+        resolver_match = getattr(request, "resolver_match", None)
+        url_name = getattr(resolver_match, "url_name", None)
+        opts = Organization._meta
+        organization_delete_url_name = f"{opts.app_label}_{opts.model_name}_delete"
+        organization_changelist_url_name = (
+            f"{opts.app_label}_{opts.model_name}_changelist"
+        )
+        active_organizations = 0
+        if request.method == "GET" and url_name == organization_delete_url_name:
+            request._active_device_delete_warning_checked = True
+            active_organizations = (
+                Device.objects.filter(
+                    organization_id=obj.organization_id,
+                    _is_deactivated=False,
+                )
+                .values("organization_id")
+                .distinct()
+                .count()
+            )
+        elif (
+            url_name == organization_changelist_url_name
+            and request.POST.get("action") == "delete_selected"
+            and not request.POST.get("post")
+        ):
+            request._active_device_delete_warning_checked = True
+            organizations = self.admin_site.get_model_admin(Organization).get_queryset(
+                request
+            )
+            active_organizations = (
+                Device.objects.filter(
+                    organization_id__in=organizations.filter(
+                        pk__in=request.POST.getlist(helpers.ACTION_CHECKBOX_NAME)
+                    ),
+                    _is_deactivated=False,
+                )
+                .values("organization_id")
+                .distinct()
+                .count()
+            )
+        if not active_organizations:
+            return
+        self.message_user(
+            request,
+            ngettext_lazy(
+                "This organization contains active devices. It is highly "
+                "recommended to deactivate them before deleting the organization "
+                "to ensure sensitive configuration data is disposed of safely.",
+                "%(count)d organizations contain active devices. It is highly "
+                "recommended to deactivate them before deleting the organizations "
+                "to ensure sensitive configuration data is disposed of safely.",
+                active_organizations,
+            )
+            % {"count": active_organizations},
+            messages.WARNING,
+        )
+
     def save_form(self, request, form, change):
         self._state_adding = form.instance._state.adding
         return super().save_form(request, form, change)
@@ -656,6 +744,7 @@ class DeviceAdmin(MultitenantAdminMixin, BaseConfigAdmin, UUIDAdmin):
             form = ChangeDeviceGroupForm(data=request.POST, org_id=org_id)
             if form.is_valid():
                 group = form.cleaned_data["device_group"]
+                queryset = queryset.filter(_is_deactivated=False)
                 # Evaluate queryset to store old group id
                 old_group_qs = list(queryset)
                 queryset.update(group=group or None)
@@ -683,8 +772,7 @@ class DeviceAdmin(MultitenantAdminMixin, BaseConfigAdmin, UUIDAdmin):
             "action_checkbox_name": helpers.ACTION_CHECKBOX_NAME,
             "opts": self.model._meta,
             "changelist_url": (
-                f"{request.resolver_match.app_name}:"
-                f"{request.resolver_match.url_name}"
+                f"{request.resolver_match.app_name}:{request.resolver_match.url_name}"
             ),
         }
 
@@ -928,6 +1016,10 @@ class DeviceAdmin(MultitenantAdminMixin, BaseConfigAdmin, UUIDAdmin):
                 ),
             }
         )
+        # passing the whois details to the context to avoid
+        # the need to make an additional request in the js
+        if data := get_whois_info(pk):
+            ctx["device_whois_details"] = data
         return ctx
 
     def add_view(self, request, form_url="", extra_context=None):
@@ -1046,7 +1138,7 @@ class TemplateAdmin(MultitenantAdminMixin, BaseConfigAdmin, SystemDefinedVariabl
         "required",
         "created",
     ]
-    search_fields = ["name"]
+    search_fields = ["name", "notes"]
     multitenant_shared_relations = ("vpn",)
     fields = [
         "name",
@@ -1058,6 +1150,7 @@ class TemplateAdmin(MultitenantAdminMixin, BaseConfigAdmin, SystemDefinedVariabl
         "tags",
         "default",
         "required",
+        "notes",
         "system_context",
         "default_values",
         "config",
@@ -1089,8 +1182,7 @@ class TemplateAdmin(MultitenantAdminMixin, BaseConfigAdmin, SystemDefinedVariabl
                     validated_org = Organization.objects.get(pk=organization)
                 except (ValidationError, Organization.DoesNotExist) as e:
                     logger.warning(
-                        "Detected tampering in clone template "
-                        f"form by user {user}: {e}"
+                        f"Detected tampering in clone template form by user {user}: {e}"
                     )
                     return
                 if not user.is_superuser and not user.is_manager(organization):
@@ -1202,7 +1294,10 @@ class VpnForm(forms.ModelForm):
 
 
 class VpnAdmin(
-    MultitenantAdminMixin, BaseConfigAdmin, UUIDAdmin, SystemDefinedVariableMixin
+    MultitenantAdminMixin,
+    BaseConfigAdmin,
+    CopyableFieldsAdmin,
+    SystemDefinedVariableMixin,
 ):
     form = VpnForm
     list_display = [
@@ -1223,6 +1318,7 @@ class VpnAdmin(
     ]
     search_fields = ["id", "name", "host", "key"]
     readonly_fields = ["id", "uuid", "system_context"]
+    copyable_fields = ["uuid"]
     multitenant_shared_relations = ("ca", "cert", "subnet")
     autocomplete_fields = ["ip", "subnet"]
     fields = [
@@ -1293,12 +1389,19 @@ class DeviceGroupAdmin(MultitenantAdminMixin, BaseAdmin):
         "created",
         "modified",
     ]
-    search_fields = ["name", "description", "meta_data"]
+    search_fields = ["name", "description", "_meta_data_text"]
     list_filter = [MultitenantOrgFilter, DeviceGroupFilter]
     multitenant_shared_relations = ("templates",)
 
+    def get_search_results(self, request, queryset, search_term):
+        if search_term:
+            queryset = queryset.annotate(
+                _meta_data_text=Cast("meta_data", output_field=models.TextField()),
+            )
+        return super().get_search_results(request, queryset, search_term)
+
     class Media:
-        js = list(UUIDAdmin.Media.js) + [
+        js = list(CopyableFieldsAdmin.Media.js) + [
             f"{prefix}js/relevant_templates.js",
         ]
         css = {"all": (f"{prefix}css/admin.css",)}
@@ -1362,18 +1465,29 @@ class OrganizationLimitsInline(admin.StackedInline):
 
 
 limits_inline_position = 0
-if getattr(app_settings, "REGISTRATION_ENABLED", True):
 
-    class ConfigSettingsForm(AlwaysHasChangedMixin, forms.ModelForm):
-        class Meta:
-            widgets = {"context": FlatJsonWidget}
 
-    class ConfigSettingsInline(admin.StackedInline):
-        model = OrganizationConfigSettings
-        form = ConfigSettingsForm
+class ConfigSettingsForm(AlwaysHasChangedMixin, forms.ModelForm):
+    class Meta:
+        widgets = {"context": FlatJsonWidget}
+
+
+class ConfigSettingsInline(admin.StackedInline):
+    model = OrganizationConfigSettings
+    form = ConfigSettingsForm
+
+    def get_fields(self, request, obj=None):
+        fields = []
+        if app_settings.REGISTRATION_ENABLED:
+            fields += ["registration_enabled", "shared_secret"]
+        if app_settings.WHOIS_CONFIGURED:
+            fields += ["whois_enabled"]
+        fields += ["context"]
+        return fields
+
 
-    OrganizationAdmin.save_on_top = True
-    OrganizationAdmin.inlines.insert(0, ConfigSettingsInline)
-    limits_inline_position = 1
+OrganizationAdmin.save_on_top = True
+OrganizationAdmin.inlines.insert(0, ConfigSettingsInline)
+limits_inline_position = 1
 
 OrganizationAdmin.inlines.insert(limits_inline_position, OrganizationLimitsInline)

{openwisp_controller-1.2.3 → openwisp_controller-1.3.1}/openwisp_controller/config/api/serializers.py

@@ -9,6 +9,7 @@ from openwisp_utils.api.serializers import ValidatedModelSerializer
 
 from ...serializers import BaseSerializer
 from .. import settings as app_settings
+from ..whois.mixins import WHOISMixin
 
 Template = load_model("config", "Template")
 Vpn = load_model("config", "Vpn")
@@ -40,6 +41,7 @@ class TemplateSerializer(BaseSerializer):
             "tags",
             "default",
             "required",
+            "notes",
             "default_values",
             "config",
             "created",
@@ -70,6 +72,7 @@ class TemplateSerializer(BaseSerializer):
 
 class VpnSerializer(BaseSerializer):
     config = serializers.JSONField(initial={})
+    ip = serializers.PrimaryKeyRelatedField(read_only=True)
     include_shared = True
 
     class Meta(BaseMeta):
@@ -83,6 +86,10 @@ class VpnSerializer(BaseSerializer):
             "ca",
             "cert",
             "backend",
+            "subnet",
+            "ip",
+            "webhook_endpoint",
+            "auth_token",
             "notes",
             "dh",
             "config",
@@ -90,6 +97,28 @@ class VpnSerializer(BaseSerializer):
             "modified",
         ]
 
+    def validate(self, data):
+        """Validates the VPN and clears the certificate if CA is changed.
+
+        When the CA is updated on an existing VPN, the current certificate
+        (which was issued by the old CA) becomes invalid. This method clears
+        the certificate so the model's ``save()`` method can auto-create a
+        new one for the new CA.
+        """
+        if self.instance and "ca" in data and self.instance.cert:
+            # if the CA is changed and new cert not supplied,
+            # allow creating a new certificate automatically
+            if data["ca"] and self.instance.cert.ca != data["ca"]:
+                data["cert"] = None
+        return super().validate(data)
+
+
+class VpnListSerializer(VpnSerializer):
+    class Meta(VpnSerializer.Meta):
+        fields = VpnSerializer.Meta.fields[:]
+        fields.remove("webhook_endpoint")
+        fields.remove("auth_token")
+
 
 class FilterTemplatesByOrganization(serializers.PrimaryKeyRelatedField):
     def get_queryset(self):
@@ -274,7 +303,7 @@ class DeviceDetailConfigSerializer(BaseConfigSerializer):
     templates = FilterTemplatesByOrganization(many=True)
 
 
-class DeviceDetailSerializer(DeviceConfigSerializer):
+class DeviceDetailSerializer(WHOISMixin, DeviceConfigSerializer):
     config = DeviceDetailConfigSerializer(allow_null=True)
     is_deactivated = serializers.BooleanField(read_only=True)