Upgrade xapian to 1.4.31 and add sha256 check to avoid supply chain attack

Fix pagination

core/management/commands/install_xapian.py

@@ -39,12 +39,16 @@ class Command(BaseCommand):
             return None
         return xapian.version_string()
 
-    def _desired_version(self) -> str:
+    def _desired_version(self) -> tuple[str, str, str]:
         with open(
             Path(__file__).parent.parent.parent.parent / "pyproject.toml", "rb"
         ) as f:
             pyproject = tomli.load(f)
-            return pyproject["tool"]["xapian"]["version"]
+            return (
+                pyproject["tool"]["xapian"]["version"],
+                pyproject["tool"]["xapian"]["core-sha256"],
+                pyproject["tool"]["xapian"]["bindings-sha256"],
+            )
 
     def handle(self, *args, force: bool, **options):
         if not os.environ.get("VIRTUAL_ENV", None):
@@ -53,7 +57,7 @@ class Command(BaseCommand):
             )
             return
 
-        desired = self._desired_version()
+        desired, core_checksum, bindings_checksum = self._desired_version()
         if desired == self._current_version():
             if not force:
                 self.stdout.write(
@@ -65,7 +69,12 @@ class Command(BaseCommand):
             f"Installing xapian version {desired} at {os.environ['VIRTUAL_ENV']}"
         )
         subprocess.run(
-            [str(Path(__file__).parent / "install_xapian.sh"), desired],
+            [
+                str(Path(__file__).parent / "install_xapian.sh"),
+                desired,
+                core_checksum,
+                bindings_checksum,
+            ],
             env=dict(os.environ),
             check=True,
         )

core/management/commands/install_xapian.sh

@@ -1,7 +1,11 @@
 #!/usr/bin/env bash
 # Originates from https://gist.github.com/jorgecarleitao/ab6246c86c936b9c55fd
 # first argument of the script is Xapian version (e.g. 1.2.19)
+# second argument of the script is core sha256
+# second argument of the script is binding sha256
 VERSION="$1"
+CORE_SHA256="$2"
+BINDINGS_SHA256="$3"
 
 # Cleanup env vars for auto discovery mechanism
 unset CPATH
@@ -21,9 +25,15 @@ BINDINGS=xapian-bindings-$VERSION
 
 # download
 echo "Downloading source..."
-curl -O "https://oligarchy.co.uk/xapian/$VERSION/${CORE}.tar.xz"
+curl -O "https://oligarchy.co.uk/xapian/$VERSION/${CORE}.tar.xz" || exit 1
+
+echo "${CORE_SHA256}  ${CORE}.tar.xz" | sha256sum -c - || exit 1
+
 curl -O "https://oligarchy.co.uk/xapian/$VERSION/${BINDINGS}.tar.xz"
 
+echo "${BINDINGS_SHA256}  ${BINDINGS}.tar.xz" | sha256sum -c - || exit 1
+
+
 # extract
 echo "Extracting source..."
 tar xf "${CORE}.tar.xz"

core/templates/core/file_moderation.jinja

@@ -48,6 +48,6 @@
           >{% trans %}Delete{% endtrans %}</button></p>
       </div>
     {% endfor %}
-    {{ paginate_htmx(page_obj, paginator) }}
+    {{ paginate_htmx(request, page_obj, paginator) }}
   </div>
 {% endblock %}

core/templates/core/macros.jinja

@@ -118,20 +118,21 @@
   </nav>
 {% endmacro %}
 
-{% macro paginate_jinja(current_page, paginator) %}
+{% macro paginate_jinja(request, current_page, paginator) %}
     {# Add pagination buttons for pages without Alpine.
 
     This must be coupled with a view that handles pagination
     with the Django Paginator object.
 
     Parameters:
+        request (django.http.request.HttpRequest): the current django request
         current_page (django.core.paginator.Page): the current page object
         paginator (django.core.paginator.Paginator): the paginator object
     #}
-  {{ paginate_server_side(current_page, paginator, False) }}
+  {{ paginate_server_side(request, current_page, paginator, False) }}
 {% endmacro %}
 
-{% macro paginate_htmx(current_page, paginator) %}
+{% macro paginate_htmx(request, current_page, paginator) %}
     {# Add pagination buttons for pages without Alpine but supporting fragments.
 
     This must be coupled with a view that handles pagination
@@ -140,24 +141,25 @@
     The replaced fragment will be #content so make sure you are calling this macro inside your content block.
 
     Parameters:
+        request (django.http.request.HttpRequest): the current django request
         current_page (django.core.paginator.Page): the current page object
         paginator (django.core.paginator.Paginator): the paginator object
     #}
-  {{ paginate_server_side(current_page, paginator, True) }}
+  {{ paginate_server_side(request, current_page, paginator, True) }}
 {% endmacro %}
 
-{% macro paginate_server_side(current_page, paginator, use_htmx) %}
+{% macro paginate_server_side(request, current_page, paginator, use_htmx) %}
   <nav class="pagination">
     {% if current_page.has_previous() %}
       <a
         {% if use_htmx -%}
-          hx-get="?{{ querystring(page=current_page.previous_page_number()) }}"
+          hx-get="?{{ querystring(request, page=current_page.previous_page_number()) }}"
           hx-swap="innerHTML"
           hx-target="#content"
           hx-push-url="true"
           hx-trigger="click, keyup[key=='ArrowLeft'] from:body"
         {%- else -%}
-          href="?{{ querystring(page=current_page.previous_page_number()) }}"
+          href="?{{ querystring(request, page=current_page.previous_page_number()) }}"
         {%- endif -%}
       >
         <button>
@@ -175,12 +177,12 @@
       {% else %}
         <a
           {% if use_htmx -%}
-            hx-get="?{{ querystring(page=i) }}"
+            hx-get="?{{ querystring(request, page=i) }}"
             hx-swap="innerHTML"
             hx-target="#content"
             hx-push-url="true"
           {%- else -%}
-            href="?{{ querystring(page=i) }}"
+            href="?{{ querystring(request, page=i) }}"
           {%- endif -%}
         >
           <button>{{ i }}</button>
@@ -190,13 +192,13 @@
     {% if current_page.has_next() %}
       <a
         {% if use_htmx -%}
-          hx-get="?{{querystring(page=current_page.next_page_number())}}"
+          hx-get="?{{querystring(request, page=current_page.next_page_number())}}"
           hx-swap="innerHTML"
           hx-target="#content"
           hx-push-url="true"
           hx-trigger="click, keyup[key=='ArrowRight'] from:body"
         {%- else -%}
-          href="?{{querystring(page=current_page.next_page_number())}}"
+          href="?{{querystring(request, page=current_page.next_page_number())}}"
         {%- endif -%}
       ><button>
         <i class="fa fa-caret-right"></i>
@@ -247,15 +249,8 @@
 {% endmacro %}
 
 
-{% macro querystring() %}
-  {%- for key, values in request.GET.lists() -%}
-    {%- if key not in kwargs -%}
-      {%- for value in values -%}
-        {{ key }}={{ value }}&amp;
-      {%- endfor -%}
-    {%- endif -%}
-  {%- endfor -%}
-  {%- for key, value in kwargs.items() -%}
-    {{ key }}={{ value }}&amp;
-  {%- endfor -%}
+{% macro querystring(request) %}
+  {%- set qs = request.GET.copy() -%}
+  {%- do qs.update(kwargs) -%}
+  {{- qs | urlencode -}}
 {% endmacro %}

counter/templates/counter/cash_summary_list.jinja

@@ -57,7 +57,7 @@
     </table>
     <br>
     {% if is_paginated %}
-      {{ paginate_jinja(page_obj, paginator) }}
+      {{ paginate_jinja(request, page_obj, paginator) }}
     {% endif %}
   {% else %}
     {% trans %}There is no cash register summary in this website.{% endtrans %}

counter/templates/counter/refilling_list.jinja

@@ -28,7 +28,7 @@
       {%- endfor %}
     </table>
     {% if is_paginated %}
-      {{ paginate_jinja(page_obj, paginator) }}
+      {{ paginate_jinja(request, page_obj, paginator) }}
     {% endif %}
 {%- endblock %}
 

election/templates/election/election_list.jinja

@@ -46,7 +46,7 @@
     </section>
   {%- endfor %}
   {% if is_paginated %}
-    {{ paginate_jinja(page_obj, paginator) }}
+    {{ paginate_jinja(request, page_obj, paginator) }}
   {% endif %}
 {%- endblock %}
 

forum/templates/forum/topic.jinja

@@ -27,7 +27,7 @@
     </p>
 
     {{ display_search_bar(request) }}
-    {{ paginate_jinja(msgs, msgs.paginator) }}
+    {{ paginate_jinja(request, msgs, msgs.paginator) }}
 
     <main class="message-list">
       {% for m in msgs %}
@@ -44,7 +44,9 @@
 
     <p><a class="ib button" href="{{ url('forum:new_message', topic_id=topic.id) }}">{% trans %}Reply{% endtrans %}</a></p>
 
-    {{ paginate_jinja(msgs, msgs.paginator) }}
+    {% if is_paginated %}
+      {{ paginate_jinja(request, msgs, msgs.paginator) }}
+    {% endif %}
   </div>
 {% endblock %}
 

pyproject.toml

@@ -4,54 +4,54 @@ version = "3"
 description = "Le web Sith de l'AE"
 readme = "README.md"
 authors = [
-    { name = "Skia", email = "skia@hya.sk" },
-    { name = "klmp200", email = "antoine@bartuccio.fr" },
-    { name = "Krophil", email = "pierre.brunet@krophil.fr" },
-    { name = "Maréchal", email = "thgirod@hotmail.com" },
-    { name = "Och", email = "francescowitz68@gmail.com" },
-    { name = "tleb", email = "tleb@openmailbox.org" },
-    { name = "Soldat", email = "ryan-68@live.fr" },
-    { name = "Nabos", email = "gnikwo@hotmail.com" },
-    { name = "Terre", email = "jbaptiste.lenglet+git@gmail.com" },
-    { name = "Lo-J", email = "renaudg779@gmail.com" },
-    { name = "Vial", email = "robin.trioux@utbm.fr" },
+  { name = "Skia", email = "skia@hya.sk" },
+  { name = "klmp200", email = "antoine@bartuccio.fr" },
+  { name = "Krophil", email = "pierre.brunet@krophil.fr" },
+  { name = "Maréchal", email = "thgirod@hotmail.com" },
+  { name = "Och", email = "francescowitz68@gmail.com" },
+  { name = "tleb", email = "tleb@openmailbox.org" },
+  { name = "Soldat", email = "ryan-68@live.fr" },
+  { name = "Nabos", email = "gnikwo@hotmail.com" },
+  { name = "Terre", email = "jbaptiste.lenglet+git@gmail.com" },
+  { name = "Lo-J", email = "renaudg779@gmail.com" },
+  { name = "Vial", email = "robin.trioux@utbm.fr" },
 ]
 license = { text = "GPL-3.0-only" }
 requires-python = "<4.0,>=3.12"
 dependencies = [
-    "django>=5.2.12,<6.0.0",
-    "django-ninja>=1.5.3,<6.0.0",
-    "django-ninja-extra>=0.31.0",
-    "Pillow>=12.1.1,<13.0.0",
-    "mistune>=3.2.0,<4.0.0",
-    "django-jinja<3.0.0,>=2.11.0",
-    "cryptography>=46.0.5,<47.0.0",
-    "django-phonenumber-field>=8.4.0,<9.0.0",
-    "phonenumbers>=9.0.25,<10.0.0",
-    "reportlab>=4.4.10,<5.0.0",
-    "django-haystack<4.0.0,>=3.3.0",
-    "xapian-haystack<4.0.0,>=3.1.0",
-    "libsass<1.0.0,>=0.23.0",
-    "django-ordered-model<4.0.0,>=3.7.4",
-    "django-simple-captcha<1.0.0,>=0.6.3",
-    "python-dateutil<3.0.0.0,>=2.9.0.post0",
-    "sentry-sdk>=2.54.0,<3.0.0",
-    "jinja2<4.0.0,>=3.1.6",
-    "django-countries>=8.2.0,<9.0.0",
-    "dict2xml>=1.7.8,<2.0.0",
-    "Sphinx<6,>=5",
-    "tomli>=2.4.0,<3.0.0",
-    "django-honeypot>=1.3.0,<2",
-    "pydantic-extra-types>=2.11.0,<3.0.0",
-    "ical>=11.1.0,<12",
-    "redis[hiredis]>=5.3.0,<8.0.0",
-    "environs[django]>=14.5.0,<15.0.0",
-    "requests>=2.32.5,<3.0.0",
-    "honcho>=2.0.0",
-    "psutil>=7.2.2,<8.0.0",
-    "celery[redis]>=5.6.2,<7",
-    "django-celery-results>=2.5.1",
-    "django-celery-beat>=2.9.0",
+  "django>=5.2.12,<6.0.0",
+  "django-ninja>=1.5.3,<6.0.0",
+  "django-ninja-extra>=0.31.0",
+  "Pillow>=12.1.1,<13.0.0",
+  "mistune>=3.2.0,<4.0.0",
+  "django-jinja<3.0.0,>=2.11.0",
+  "cryptography>=46.0.5,<47.0.0",
+  "django-phonenumber-field>=8.4.0,<9.0.0",
+  "phonenumbers>=9.0.25,<10.0.0",
+  "reportlab>=4.4.10,<5.0.0",
+  "django-haystack<4.0.0,>=3.3.0",
+  "xapian-haystack<4.0.0,>=3.1.0",
+  "libsass<1.0.0,>=0.23.0",
+  "django-ordered-model<4.0.0,>=3.7.4",
+  "django-simple-captcha<1.0.0,>=0.6.3",
+  "python-dateutil<3.0.0.0,>=2.9.0.post0",
+  "sentry-sdk>=2.54.0,<3.0.0",
+  "jinja2<4.0.0,>=3.1.6",
+  "django-countries>=8.2.0,<9.0.0",
+  "dict2xml>=1.7.8,<2.0.0",
+  "Sphinx<6,>=5",
+  "tomli>=2.4.0,<3.0.0",
+  "django-honeypot>=1.3.0,<2",
+  "pydantic-extra-types>=2.11.0,<3.0.0",
+  "ical>=11.1.0,<12",
+  "redis[hiredis]>=5.3.0,<8.0.0",
+  "environs[django]>=14.5.0,<15.0.0",
+  "requests>=2.32.5,<3.0.0",
+  "honcho>=2.0.0",
+  "psutil>=7.2.2,<8.0.0",
+  "celery[redis]>=5.6.2,<7",
+  "django-celery-results>=2.5.1",
+  "django-celery-beat>=2.9.0",
 ]
 
 [project.urls]
@@ -59,73 +59,74 @@ homepage = "https://ae.utbm.fr/"
 documentation = "https://sith-ae.readthedocs.io/"
 
 [dependency-groups]
-prod = [
-    "psycopg[c]>=3.3.3,<4.0.0",
-]
+prod = ["psycopg[c]>=3.3.3,<4.0.0"]
 dev = [
-    "django-debug-toolbar>=6.2.0,<7",
-    "ipython>=9.11.0,<10.0.0",
-    "pre-commit>=4.5.1,<5.0.0",
-    "ruff>=0.15.5,<1.0.0",
-    "djhtml>=3.0.10,<4.0.0",
-    "faker>=40.8.0,<41.0.0",
-    "rjsmin>=1.2.5,<2.0.0",
+  "django-debug-toolbar>=6.2.0,<7",
+  "ipython>=9.11.0,<10.0.0",
+  "pre-commit>=4.5.1,<5.0.0",
+  "ruff>=0.15.5,<1.0.0",
+  "djhtml>=3.0.10,<4.0.0",
+  "faker>=40.8.0,<41.0.0",
+  "rjsmin>=1.2.5,<2.0.0",
 ]
 tests = [
-    "freezegun>=1.5.5,<2.0.0",
-    "pytest>=9.0.2,<10.0.0",
-    "pytest-cov>=7.0.0,<8.0.0",
-    "pytest-django<5.0.0,>=4.12.0",
-    "model-bakery<2.0.0,>=1.23.3",
-    "beautifulsoup4>=4.14.3,<5",
-    "lxml>=6.0.2,<7",
+  "freezegun>=1.5.5,<2.0.0",
+  "pytest>=9.0.2,<10.0.0",
+  "pytest-cov>=7.0.0,<8.0.0",
+  "pytest-django<5.0.0,>=4.12.0",
+  "model-bakery<2.0.0,>=1.23.3",
+  "beautifulsoup4>=4.14.3,<5",
+  "lxml>=6.0.2,<7",
 ]
 docs = [
-    "mkdocs<2.0.0,>=1.6.1",
-    "mkdocs-material>=9.7.5,<10.0.0",
-    "mkdocstrings>=1.0.3,<2.0.0",
-    "mkdocstrings-python>=2.0.3,<3.0.0",
-    "mkdocs-include-markdown-plugin>=7.2.1,<8.0.0",
+  "mkdocs<2.0.0,>=1.6.1",
+  "mkdocs-material>=9.7.5,<10.0.0",
+  "mkdocstrings>=1.0.3,<2.0.0",
+  "mkdocstrings-python>=2.0.3,<3.0.0",
+  "mkdocs-include-markdown-plugin>=7.2.1,<8.0.0",
 ]
 
 [tool.uv]
 default-groups = ["dev", "tests", "docs"]
 
 [tool.xapian]
-version = "1.4.29"
+version = "1.4.31"
+core-sha256 = "fecf609ea2efdc8a64be369715aac733336a11f7480a6545244964ae6bc80811"
+bindings-sha256 = "a38cc7ba4188cc0bd27dc7369f03906772047087a1c54f1b93355d5e9103c304"
+
 
 [tool.ruff]
 output-format = "concise" # makes ruff error logs easier to read
 
 [tool.ruff.lint]
 select = [
-    "A", # shadowing of Python builtins
-    "B",
-    "C4", # use comprehensions when possible
-    "DJ", # django-specific rules,
-    "E", # pycodestyle (https://docs.astral.sh/ruff/rules/#pycodestyle-e-w)
-    "ERA", # commented code
-    "F", # pyflakes (https://docs.astral.sh/ruff/rules/#pyflakes-f)
-    "FBT", # boolean trap
-    "FLY", # f-string instead of str.join
-    "FURB", # https://docs.astral.sh/ruff/rules/#refurb-furb
-    "I", # isort
-    "INT", # gettext
-    "PERF", # performance
-    "PLW", # pylint warnings (https://docs.astral.sh/ruff/rules/#pylint-pl)
-    "RUF", # Ruff specific rules
-    "SIM", # simplify (https://docs.astral.sh/ruff/rules/#flake8-simplify-sim)
-    "T100", # breakpoint()
-    "T2", # print statements
-    "TCH", # type-checking block
-    "UP008", # Use super() instead of super(__class__, self)
-    "UP009", # utf-8 encoding declaration is unnecessary
+  "A",     # shadowing of Python builtins
+  "B",
+  "C4",    # use comprehensions when possible
+  "DJ",    # django-specific rules,
+  "E",     # pycodestyle (https://docs.astral.sh/ruff/rules/#pycodestyle-e-w)
+  "ERA",   # commented code
+  "F",     # pyflakes (https://docs.astral.sh/ruff/rules/#pyflakes-f)
+  "FBT",   # boolean trap
+  "FLY",   # f-string instead of str.join
+  "FURB",  # https://docs.astral.sh/ruff/rules/#refurb-furb
+  "I",     # isort
+  "INT",   # gettext
+  "PERF",  # performance
+  "PLW",   # pylint warnings (https://docs.astral.sh/ruff/rules/#pylint-pl)
+  "RUF",   # Ruff specific rules
+  "SIM",   # simplify (https://docs.astral.sh/ruff/rules/#flake8-simplify-sim)
+  "T100",  # breakpoint()
+  "T2",    # print statements
+  "TCH",   # type-checking block
+  "UP008", # Use super() instead of super(__class__, self)
+  "UP009", # utf-8 encoding declaration is unnecessary
 ]
 
 ignore = [
-    "DJ001", # null=True in CharField/TextField. this one would require a migration
-    "E501", # line too long. The rule is too harsh, and the formatter deals with it in most cases
-    "RUF012"  # mutable class attributes. This rule doesn't integrate well with django
+  "DJ001",  # null=True in CharField/TextField. this one would require a migration
+  "E501",   # line too long. The rule is too harsh, and the formatter deals with it in most cases
+  "RUF012", # mutable class attributes. This rule doesn't integrate well with django
 ]
 
 [tool.ruff.lint.pydocstyle]

rootplace/templates/rootplace/logs.jinja

@@ -28,5 +28,7 @@
   </table>
 
   <br>
-  {{ paginate_jinja(page_obj, paginator) }}
+  {% if is_paginated %}
+    {{ paginate_jinja(request, page_obj, paginator) }}
+  {% endif %}
 {% endblock content %}