rapid-router 7.5.10__py2.py3-none-any.whl → 7.5.12__py2.py3-none-any.whl

game/__init__.py

@@ -1 +1 @@
-__version__ = "7.5.10"
+__version__ = "7.5.12"

game/tests/test_level_editor.py

@@ -488,3 +488,38 @@ class LevelEditorTestCase(TestCase):
         # Teacher shouldn't see any shared levels now
         response = self.client.get(levels_url)
         assert len(response.context["directly_shared_levels"]) == 0
+
+    def test_level_cannot_be_created_with_invalid_fields(self):
+        email, password = signup_teacher_directly()
+        create_organisation_directly(email)
+        _, _, access_code = create_class_directly(email)
+        create_school_student_directly(access_code)
+
+        level_data = self.LEVEL_DATA1
+        level_data["subtitle"] = "<a>invalid subtitle</a>"
+
+        self.login(email, password)
+        url = reverse("save_level_for_editor")
+        response = self.client.post(url, {"data": json.dumps(self.LEVEL_DATA1)})
+
+        assert response.status_code == 401
+
+        level_data["subtitle"] = "valid subtitle"
+        level_data["lesson"] = "<a>invalid lesson</a>"
+
+        response = self.client.post(url, {"data": json.dumps(self.LEVEL_DATA1)})
+
+        assert response.status_code == 401
+
+        level_data["lesson"] = "valid lesson"
+        level_data["hint"] = "<a>invalid hint</a>"
+
+        response = self.client.post(url, {"data": json.dumps(self.LEVEL_DATA1)})
+
+        assert response.status_code == 401
+
+        level_data["hint"] = "valid hint"
+
+        response = self.client.post(url, {"data": json.dumps(self.LEVEL_DATA1)})
+
+        assert response.status_code == 200

game/views/level_editor.py

@@ -221,80 +221,88 @@ def save_level_for_editor(request, levelId=None):
     if not permissions.can_save_level(request.user, level):
         return HttpResponseUnauthorized()
 
-    pattern = re.compile("^(\w?[ ]?)*$")
+    name_pattern = re.compile("^(\w?[ ]?)*$")
+    fields_pattern = re.compile("^[\w.?!', ]*$")
+
+    name_is_safe = name_pattern.match(data["name"])
+    fields_are_safe = all(
+        [
+            field not in data or fields_pattern.match(data[field])
+            for field in ["subtitle", "lesson", "hint"]
+        ]
+    )
 
-    if pattern.match(data["name"]):
-        level_management.save_level(level, data)
+    if not (name_is_safe and fields_are_safe):
+        return HttpResponseUnauthorized()
 
-        is_user_school_student = (
-                hasattr(level.owner, "student")
-                and not level.owner.student.is_independent()
-        )
-        is_user_independent = (
-                hasattr(level.owner, "student") and level.owner.student.is_independent()
-        )
-        is_user_teacher = hasattr(level.owner, "teacher")
-
-        # when level is created
-        if levelId is None:
-            teacher = None
-
-            # if level owner is a school student, share with teacher automatically if they aren't an admin
-            if is_user_school_student:
-                teacher = level.owner.student.class_field.teacher
-                if not teacher.is_admin:
-                    level.shared_with.add(teacher.new_user)
-
-                if not data["anonymous"]:
-                    level_management.email_new_custom_level(
-                        teacher.new_user.email,
-                        request.build_absolute_uri(reverse("level_moderation")),
-                        request.build_absolute_uri(
-                            reverse("play_custom_level", kwargs={"levelId": level.id})
-                        ),
-                        str(level.owner.student),
-                        level.owner.student.class_field.name,
-                    )
+    level_management.save_level(level, data)
 
-            elif is_user_teacher:
-                teacher = level.owner.teacher
+    is_user_school_student = (
+        hasattr(level.owner, "student") and not level.owner.student.is_independent()
+    )
+    is_user_independent = (
+        hasattr(level.owner, "student") and level.owner.student.is_independent()
+    )
+    is_user_teacher = hasattr(level.owner, "teacher")
 
-            # if level owner is a teacher or an indy user, approval isn't needed
-            if not is_user_school_student:
-                level.needs_approval = False
+    # when level is created
+    if levelId is None:
+        teacher = None
 
-            # share with all admins of the school if user is in a school
-            if not is_user_independent:
-                if not teacher.school is None:
-                    school_admins = teacher.school.admins()
+        # if level owner is a school student, share with teacher automatically if they aren't an admin
+        if is_user_school_student:
+            teacher = level.owner.student.class_field.teacher
+            if not teacher.is_admin:
+                level.shared_with.add(teacher.new_user)
+
+            if not data["anonymous"]:
+                level_management.email_new_custom_level(
+                    teacher.new_user.email,
+                    request.build_absolute_uri(reverse("level_moderation")),
+                    request.build_absolute_uri(
+                        reverse("play_custom_level", kwargs={"levelId": level.id})
+                    ),
+                    str(level.owner.student),
+                    level.owner.student.class_field.name,
+                )
 
-                    [
-                        level.shared_with.add(school_admin.new_user)
-                        for school_admin in school_admins
-                        if school_admin.new_user != request.user
-                    ]
+        elif is_user_teacher:
+            teacher = level.owner.teacher
 
-        # anytime a student edits their level
-        if is_user_school_student:
-            if not level.needs_approval:
-                level.needs_approval = True
-
-                if not data["anonymous"]:
-                    level_management.email_new_custom_level(
-                        level.owner.student.class_field.teacher.new_user.email,
-                        request.build_absolute_uri(reverse("level_moderation")),
-                        request.build_absolute_uri(
-                            reverse("play_custom_level", kwargs={"levelId": level.id})
-                        ),
-                        str(level.owner.student),
-                        level.owner.student.class_field.name,
-                    )
+        # if level owner is a teacher or an indy user, approval isn't needed
+        if not is_user_school_student:
+            level.needs_approval = False
 
-        level.save()
-        response = {"id": level.id}
-        return HttpResponse(json.dumps(response), content_type="application/json")
-    else:
-        return HttpResponseUnauthorized()
+        # share with all admins of the school if user is in a school
+        if not is_user_independent:
+            if not teacher.school is None:
+                school_admins = teacher.school.admins()
+
+                [
+                    level.shared_with.add(school_admin.new_user)
+                    for school_admin in school_admins
+                    if school_admin.new_user != request.user
+                ]
+
+    # anytime a student edits their level
+    if is_user_school_student:
+        if not level.needs_approval:
+            level.needs_approval = True
+
+            if not data["anonymous"]:
+                level_management.email_new_custom_level(
+                    level.owner.student.class_field.teacher.new_user.email,
+                    request.build_absolute_uri(reverse("level_moderation")),
+                    request.build_absolute_uri(
+                        reverse("play_custom_level", kwargs={"levelId": level.id})
+                    ),
+                    str(level.owner.student),
+                    level.owner.student.class_field.name,
+                )
+
+    level.save()
+    response = {"id": level.id}
+    return HttpResponse(json.dumps(response), content_type="application/json")
 
 
 @transaction.atomic
@@ -397,9 +405,11 @@ class SharingInformationForEditor(APIView):
                 )
                 valid_recipients["classes"].append(
                     {
-                        "name": f"{class_.name} ({app_tags.make_into_username(class_.teacher.new_user)})"
-                        if teacher.is_admin
-                        else class_.name,
+                        "name": (
+                            f"{class_.name} ({app_tags.make_into_username(class_.teacher.new_user)})"
+                            if teacher.is_admin
+                            else class_.name
+                        ),
                         "id": class_.id,
                         "students": [
                             {

{rapid_router-7.5.10.dist-info → rapid_router-7.5.12.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rapid-router
-Version: 7.5.10
+Version: 7.5.12
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Framework :: Django
@@ -8,11 +8,11 @@ License-File: LICENSE.md
 Requires-Dist: asgiref==3.8.1; python_version >= "3.8"
 Requires-Dist: asttokens==3.0.0; python_version >= "3.8"
 Requires-Dist: certifi==2025.4.26; python_version >= "3.6"
-Requires-Dist: cfl-common==8.7.1
+Requires-Dist: cfl-common==8.7.3
 Requires-Dist: charset-normalizer==3.4.2; python_version >= "3.7"
 Requires-Dist: decorator==5.2.1; python_version >= "3.8"
 Requires-Dist: diff-match-patch==20241021; python_version >= "3.7"
-Requires-Dist: django==5.1.9; python_version >= "3.10"
+Requires-Dist: django==5.1.10; python_version >= "3.10"
 Requires-Dist: django-countries==7.6.1
 Requires-Dist: django-csp==3.8
 Requires-Dist: django-formtools==2.5.1; python_version >= "3.8"
@@ -25,14 +25,14 @@ Requires-Dist: django-two-factor-auth==1.17.0; python_version >= "3.8"
 Requires-Dist: djangorestframework==3.16.0; python_version >= "3.9"
 Requires-Dist: executing==2.2.0; python_version >= "3.8"
 Requires-Dist: idna==3.10; python_version >= "3.6"
-Requires-Dist: ipython==9.2.0; python_version >= "3.11"
+Requires-Dist: ipython==9.3.0; python_version >= "3.11"
 Requires-Dist: ipython-pygments-lexers==1.1.1; python_version >= "3.8"
 Requires-Dist: jedi==0.19.2; python_version >= "3.6"
 Requires-Dist: libsass==0.23.0; python_version >= "3.8"
 Requires-Dist: matplotlib-inline==0.1.7; python_version >= "3.8"
 Requires-Dist: more-itertools==8.7.0; python_version >= "3.5"
-Requires-Dist: numpy==2.2.5; python_version >= "3.10"
-Requires-Dist: pandas==2.2.3; python_version >= "3.9"
+Requires-Dist: numpy==2.2.6; python_version >= "3.10"
+Requires-Dist: pandas==2.3.0; python_version >= "3.9"
 Requires-Dist: parso==0.8.4; python_version >= "3.6"
 Requires-Dist: pexpect==4.9.0; sys_platform != "win32" and sys_platform != "emscripten"
 Requires-Dist: pgeocode==0.4.0; python_version >= "3.8"
@@ -43,17 +43,17 @@ Requires-Dist: pygments==2.19.1; python_version >= "3.8"
 Requires-Dist: pyhamcrest==2.0.2; python_version >= "3.5"
 Requires-Dist: pyjwt==2.6.0; python_version >= "3.7"
 Requires-Dist: pypng==0.20220715.0
-Requires-Dist: python-dateutil==2.9.0.post0; python_version >= "2.7" and python_version not in "3.0, 3.1, 3.2"
+Requires-Dist: python-dateutil==2.9.0.post0; python_version >= "2.7" and python_version not in "3.0, 3.1, 3.2, 3.3"
 Requires-Dist: pytz==2025.2
 Requires-Dist: qrcode==7.4.2; python_version >= "3.7"
 Requires-Dist: requests==2.32.3; python_version >= "3.8"
-Requires-Dist: setuptools==80.3.1; python_version >= "3.9"
-Requires-Dist: six==1.17.0; python_version >= "2.7" and python_version not in "3.0, 3.1, 3.2"
+Requires-Dist: setuptools==80.9.0; python_version >= "3.9"
+Requires-Dist: six==1.17.0; python_version >= "2.7" and python_version not in "3.0, 3.1, 3.2, 3.3"
 Requires-Dist: sqlparse==0.5.3; python_version >= "3.8"
 Requires-Dist: stack-data==0.6.3
 Requires-Dist: tablib==3.7.0; python_version >= "3.9"
 Requires-Dist: traitlets==5.14.3; python_version >= "3.8"
-Requires-Dist: typing-extensions==4.13.2; python_version >= "3.8"
+Requires-Dist: typing-extensions==4.14.0; python_version >= "3.9"
 Requires-Dist: tzdata==2025.2; python_version >= "2"
 Requires-Dist: urllib3==2.4.0; python_version >= "3.9"
 Requires-Dist: wcwidth==0.2.13
@@ -63,13 +63,13 @@ Requires-Dist: asgiref==3.8.1; python_version >= "3.8" and extra == "dev"
 Requires-Dist: attrs==25.3.0; python_version >= "3.8" and extra == "dev"
 Requires-Dist: black==25.1.0; python_version >= "3.9" and extra == "dev"
 Requires-Dist: certifi==2025.4.26; python_version >= "3.6" and extra == "dev"
-Requires-Dist: cfl-common==8.7.1; extra == "dev"
+Requires-Dist: cfl-common==8.7.3; extra == "dev"
 Requires-Dist: chardet==5.2.0; python_version >= "3.7" and extra == "dev"
 Requires-Dist: charset-normalizer==3.4.2; python_version >= "3.7" and extra == "dev"
 Requires-Dist: click==8.2.1; python_version >= "3.10" and extra == "dev"
-Requires-Dist: codeforlife-portal==8.7.1; extra == "dev"
+Requires-Dist: codeforlife-portal==8.7.3; extra == "dev"
 Requires-Dist: diff-match-patch==20241021; python_version >= "3.7" and extra == "dev"
-Requires-Dist: django==5.1.9; python_version >= "3.10" and extra == "dev"
+Requires-Dist: django==5.1.10; python_version >= "3.10" and extra == "dev"
 Requires-Dist: django-classy-tags==4.1.0; python_version >= "3.8" and extra == "dev"
 Requires-Dist: django-countries==7.6.1; extra == "dev"
 Requires-Dist: django-csp==3.8; extra == "dev"
@@ -96,45 +96,46 @@ Requires-Dist: isort==6.0.1; python_full_version >= "3.9.0" and extra == "dev"
 Requires-Dist: libsass==0.23.0; python_version >= "3.8" and extra == "dev"
 Requires-Dist: more-itertools==8.7.0; python_version >= "3.5" and extra == "dev"
 Requires-Dist: mypy-extensions==1.1.0; python_version >= "3.8" and extra == "dev"
-Requires-Dist: numpy==2.2.5; python_version >= "3.10" and extra == "dev"
+Requires-Dist: numpy==2.2.6; python_version >= "3.10" and extra == "dev"
 Requires-Dist: outcome==1.3.0.post0; python_version >= "3.7" and extra == "dev"
 Requires-Dist: packaging==25.0; python_version >= "3.8" and extra == "dev"
-Requires-Dist: pandas==2.2.3; python_version >= "3.9" and extra == "dev"
+Requires-Dist: pandas==2.3.0; python_version >= "3.9" and extra == "dev"
 Requires-Dist: pathspec==0.12.1; python_version >= "3.8" and extra == "dev"
 Requires-Dist: pgeocode==0.4.0; python_version >= "3.8" and extra == "dev"
 Requires-Dist: phonenumbers==8.12.12; extra == "dev"
 Requires-Dist: pillow==11.2.1; python_version >= "3.9" and extra == "dev"
 Requires-Dist: platformdirs==4.3.8; python_version >= "3.9" and extra == "dev"
 Requires-Dist: pluggy==1.6.0; python_version >= "3.9" and extra == "dev"
+Requires-Dist: pygments==2.19.1; python_version >= "3.8" and extra == "dev"
 Requires-Dist: pyjwt==2.6.0; python_version >= "3.7" and extra == "dev"
 Requires-Dist: pypng==0.20220715.0; extra == "dev"
 Requires-Dist: pysocks==1.7.1; extra == "dev"
-Requires-Dist: pytest==8.3.5; python_version >= "3.8" and extra == "dev"
+Requires-Dist: pytest==8.4.0; python_version >= "3.9" and extra == "dev"
 Requires-Dist: pytest-django==4.8.0; python_version >= "3.8" and extra == "dev"
 Requires-Dist: pytest-order==1.3.0; python_version >= "3.7" and extra == "dev"
 Requires-Dist: pytest-xdist==3.7.0; python_version >= "3.9" and extra == "dev"
-Requires-Dist: python-dateutil==2.9.0.post0; (python_version >= "2.7" and python_version not in "3.0, 3.1, 3.2") and extra == "dev"
+Requires-Dist: python-dateutil==2.9.0.post0; (python_version >= "2.7" and python_version not in "3.0, 3.1, 3.2, 3.3") and extra == "dev"
 Requires-Dist: pytz==2025.2; extra == "dev"
 Requires-Dist: pyyaml==6.0.2; python_version >= "3.8" and extra == "dev"
 Requires-Dist: qrcode==7.4.2; python_version >= "3.7" and extra == "dev"
 Requires-Dist: reportlab==4.2.5; (python_version >= "3.7" and python_version < "4") and extra == "dev"
 Requires-Dist: requests==2.32.3; python_version >= "3.8" and extra == "dev"
 Requires-Dist: selenium==4.29.0; python_version >= "3.9" and extra == "dev"
-Requires-Dist: setuptools==80.3.1; python_version >= "3.9" and extra == "dev"
-Requires-Dist: six==1.17.0; (python_version >= "2.7" and python_version not in "3.0, 3.1, 3.2") and extra == "dev"
+Requires-Dist: setuptools==80.9.0; python_version >= "3.9" and extra == "dev"
+Requires-Dist: six==1.17.0; (python_version >= "2.7" and python_version not in "3.0, 3.1, 3.2, 3.3") and extra == "dev"
 Requires-Dist: sniffio==1.3.1; python_version >= "3.7" and extra == "dev"
 Requires-Dist: sortedcontainers==2.4.0; extra == "dev"
 Requires-Dist: sqlparse==0.5.3; python_version >= "3.8" and extra == "dev"
 Requires-Dist: tablib==3.7.0; python_version >= "3.9" and extra == "dev"
 Requires-Dist: trio==0.30.0; python_version >= "3.9" and extra == "dev"
 Requires-Dist: trio-websocket==0.12.2; python_version >= "3.8" and extra == "dev"
-Requires-Dist: typing-extensions==4.13.2; python_version >= "3.8" and extra == "dev"
+Requires-Dist: typing-extensions==4.14.0; python_version >= "3.9" and extra == "dev"
 Requires-Dist: tzdata==2025.2; python_version >= "2" and extra == "dev"
 Requires-Dist: urllib3==2.4.0; python_version >= "3.9" and extra == "dev"
 Requires-Dist: websocket-client==1.8.0; python_version >= "3.8" and extra == "dev"
 Requires-Dist: wheel==0.45.1; python_version >= "3.8" and extra == "dev"
 Requires-Dist: wsproto==1.2.0; python_full_version >= "3.7.0" and extra == "dev"
-Requires-Dist: zipp==3.21.0; python_version >= "3.9" and extra == "dev"
+Requires-Dist: zipp==3.22.0; python_version >= "3.9" and extra == "dev"
 Dynamic: classifier
 Dynamic: license-file
 Dynamic: provides-extra

{rapid_router-7.5.10.dist-info → rapid_router-7.5.12.dist-info}/RECORD

@@ -3,7 +3,7 @@ example_project/rapid_router_test_settings.py,sha256=3PPkhCEztAn-WGLQ-Bf2hA5n1q_
 example_project/settings.py,sha256=-Lsw_DJow_LaKaTE4DNfY69o3cclXUHNoWNybPBHIqY,4333
 example_project/urls.py,sha256=XHug_cpNy21yOef3E1-wWT5VkTuxpl6ZXIlCj6jDjWA,422
 example_project/wsgi.py,sha256=U1W6WzZxZaIdYZ5tks7w9fqp5WS5qvn2iThsVcskrWw,829
-game/__init__.py,sha256=F_qKRkryDfrCkcPV55mU0KLe6QhfXJyH9Rfx4Yg-Uu0,23
+game/__init__.py,sha256=pFUKWsutX3VUz-kNRAZXm5PflBdJ7dAo_wTAJT9qHdM,23
 game/admin.py,sha256=BLwwaqQYuqmMdwqnvhdan19iGxdcoBX4CXFk_ROG5-M,1431
 game/app_settings.py,sha256=mlg-1AiP7AR5JNOHAXXLuCrYWaZMmSihvSYk9c2c8YY,857
 game/cache.py,sha256=dtOiFl6Z4I2Q9-8Hz24ZI-5C0asXYSQhF2Be5q74N8g,2227
@@ -774,7 +774,7 @@ game/templatetags/game/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3
 game/templatetags/game/utils.py,sha256=quMDcxpoi998hHiOH6CtoxITgpVPo4iWeINFk5AHFPU,406
 game/tests/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 game/tests/test_api.py,sha256=RI2PBnSD2dOGmCdXgH8SsoHuBSRJzUv8zBA3Hzb_ASU,5688
-game/tests/test_level_editor.py,sha256=sMTbCUfxjT84fDlxJMS9dIzOIST0f8yKF_JT0FMGv8I,19565
+game/tests/test_level_editor.py,sha256=ttUMFpfpJp1Vc90X15v2i6AOItvPTwnA1BeuZ3sj9m8,20767
 game/tests/test_level_moderation.py,sha256=OcU8nx0Ih4FCR9b_tp0w4n6zWVdJ3gzftz6fa0iz67U,7057
 game/tests/test_level_selection.py,sha256=IbrIPKDozvQ-05JAmLxHw9DsTfTwTBF2VJQPU8dn2XI,11800
 game/tests/test_models.py,sha256=L1F5yHtVdDmVuhw7uGDBiOOTYi9rgZVIjzd248-eqLc,2592
@@ -794,14 +794,14 @@ game/views/api.py,sha256=j5Qwabpj0x9oJJ5iHhgGKeJ1RcHZgR5-eg3VGHPCyjE,8994
 game/views/helper.py,sha256=SR11w5rpshwSvC7v5dDFazTrH-Vpn9gOe93OLpwrVlE,548
 game/views/language_code_conversions.py,sha256=oaBqaPd5n1a4XmD1UWacpKrFYZ8Gk6CDII9sTrLDQDM,2590
 game/views/level.py,sha256=8Z5ZXnspK5Bnhy8-BeVt_Evf2JSSrRklGO7Fw3W78BA,16887
-game/views/level_editor.py,sha256=uvR-cYxb6zWUEN2kH6ZfmcaFEb6XilgARFKyRMsyIq4,18130
+game/views/level_editor.py,sha256=qJlHPs85hFCJoXrkwql37UduGs0MKxpAtwm5EpzEwi0,18227
 game/views/level_moderation.py,sha256=GwnvXlHRxGNjgjr3pcCCmnxCHEX4UCJlsGw2VA6rncA,5303
 game/views/level_selection.py,sha256=UI345nDv5iTRQ7VttiLKLzezJlaSlaKOnhlALZgMU9Q,9896
 game/views/level_solutions.py,sha256=lfwLFvw4gFuptTkL2J_ibhnuiysl3Yao15sn2qoQlcE,97194
 game/views/scoreboard.py,sha256=Lxy7XtoG7VwWpTb-c22BGC6eN8uCmmOnQ2qjY-oXA3k,16914
 game/views/scoreboard_csv.py,sha256=yx4tOwx5QsHyU1S1BUPUqRBWIh5idq8QVtBID-NqZto,1768
-rapid_router-7.5.10.dist-info/licenses/LICENSE.md,sha256=9AbRlCDqD2D1tPibimysFv3zg3AIc49-eyv9aEsyq9w,115
-rapid_router-7.5.10.dist-info/METADATA,sha256=2kIZfP3y8ldHXPMmau6dSPSI9P5kGK29lwDXRzWK31s,9111
-rapid_router-7.5.10.dist-info/WHEEL,sha256=JNWh1Fm1UdwIQV075glCn4MVuCRs0sotJIq-J6rbxCU,109
-rapid_router-7.5.10.dist-info/top_level.txt,sha256=rKP4ryr1t8Wcnx8grJHDViM3T5cMYH_0vygDjC04ArA,21
-rapid_router-7.5.10.dist-info/RECORD,,
+rapid_router-7.5.12.dist-info/licenses/LICENSE.md,sha256=9AbRlCDqD2D1tPibimysFv3zg3AIc49-eyv9aEsyq9w,115
+rapid_router-7.5.12.dist-info/METADATA,sha256=k3d-4OlAyJnh6YOk_Z4lfUmSSKwfTzjgGMlV3KMydHQ,9209
+rapid_router-7.5.12.dist-info/WHEEL,sha256=JNWh1Fm1UdwIQV075glCn4MVuCRs0sotJIq-J6rbxCU,109
+rapid_router-7.5.12.dist-info/top_level.txt,sha256=rKP4ryr1t8Wcnx8grJHDViM3T5cMYH_0vygDjC04ArA,21
+rapid_router-7.5.12.dist-info/RECORD,,