[RELEASE] 4.4.0

.github/workflows/code_formatting.yml

@@ -6,6 +6,9 @@ on:
     branches: [master, develop, main, dev_v4]
   workflow_dispatch:
 
+permissions:
+  contents: write
+
 jobs:
   code-formatting:
     runs-on: ubuntu-latest

.github/workflows/pod_dev.yml

@@ -13,6 +13,9 @@ on:
     - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   PYTHON_VERSION: '3.10'
   DJANGO_SUPERUSER_USERNAME: "admin"
@@ -93,6 +96,9 @@ jobs:
       - name: Flake8 compliance
         run: flake8
 
+      - name: Run JavaScript tests
+        run: find pod -type f -name '*.test.cjs' -print0 | xargs -0 node --test
+
       - name: Check French translations
         run: |
           make lang

.github/workflows/pod_main.yml

@@ -12,6 +12,9 @@ on:
       - master
     workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
     Pod-Main:
         runs-on: ubuntu-latest
@@ -70,6 +73,9 @@ jobs:
                 cd pod
                 yarn
 
+            - name: Run JavaScript tests
+              run: find pod -type f -name '*.test.cjs' -print0 | xargs -0 node --test
+
             - name: Run Tests without coverage
               env:
                 PYTHONUNBUFFERED: 1

.gitignore

@@ -56,6 +56,7 @@ transcription/*
 chromedriver
 
 ## Others
+.venv
 pod/static/
 *.bak
 .coverage

CONFIGURATION_FR.md

@@ -509,9 +509,12 @@ Il faudra pour cela créer un fichier de langue et traduire chaque entrée.<br>
 * `ARCHIVE_OWNER_USERNAME`
   > valeur par défaut : `"archive"`
   >> Nom de l’utilisateur pour l’archivage des vidéos.<br>
+* `ARCHIVE_ROOT`
+  > valeur par défaut : `'/video_archiving'`
+  >> Dossier dans lequel sont déplacées les vidéos après ARCHIVE_HOW_MANY_DAYS jours.<br>
 * `ARCHIVE_HOW_MANY_DAYS`
   > valeur par défaut : `365`
-  >> Délai avant qu'une vidéo archivée ne soit déplacée vers archive_ROOT.<br>
+  >> Délai avant qu'une vidéo archivée ne soit déplacée vers ARCHIVE_ROOT.<br>
 * `POD_ARCHIVE_AFFILIATION`
   > valeur par défaut : `[]`
   >> Affiliations pour lesquelles on souhaite archiver la vidéo plutôt que de la supprimer.<br>
@@ -560,7 +563,13 @@ Il faudra pour cela créer un fichier de langue et traduire chaque entrée.<br>
   >>    'respite_criteria_parameter': [...],
   >>    'archiving_criteria_parameter': {
   >>        'minimum_expected_score': value,
-  >>        'attribute_scores': [...],
+  >>        'attribute_scores': [
+  >>            'title': 2,
+  >>            'description',: 3,
+  >>            'discipline',: 2,
+  >>            'tags',: 2,
+  >>            'date_evt',: 1,
+  >>        ],
   >>        'excluded_title_terms': [...],
   >>        'excluded_discipline_terms': [...],
   >>    }

pod/authentication/tests/test_views.py

@@ -7,6 +7,7 @@
 from django.contrib.auth.models import User
 from django.conf import settings
 from django.utils.translation import gettext_lazy as _
+from urllib.parse import parse_qs, urlsplit
 
 # ggignore-start
 # gitguardian:ignore
@@ -43,6 +44,29 @@ def test_authentication_login(self) -> None:
 
         print("   --->  test_authentication_login of authenticationViewsTestCase: OK!")
 
+    def test_authentication_login_rejects_external_referrers(self) -> None:
+        """Authentication redirects must remain on the current host."""
+        login_url = settings.LOGIN_URL
+
+        for referrer in ("//evil.example", "https://testserver.evil.example/path"):
+            with self.subTest(referrer=referrer):
+                response = self.client.get(login_url, {"referrer": referrer})
+                self.assertEqual(response.status_code, 400)
+
+    def test_authentication_login_encodes_local_referrer(self) -> None:
+        """Keep a local return URL as one encoded query-string value."""
+        referrer = "/video/example/?first=1&second=2"
+        response = self.client.get(
+            settings.LOGIN_URL,
+            {"referrer": referrer, "is_iframe": "true"},
+        )
+
+        location = urlsplit(response.url)
+        query = parse_qs(location.query)
+        self.assertEqual(location.path, "/accounts/login/")
+        self.assertEqual(query["next"], [referrer])
+        self.assertEqual(query["is_iframe"], ["true"])
+
     def test_authentication_logout(self) -> None:
         self.client = Client()
         # USE_CAS is valued to False

pod/authentication/views.py

@@ -5,6 +5,8 @@
 from django.urls import reverse
 from django.conf import settings
 from django.core.exceptions import SuspiciousOperation
+from django.http import QueryDict
+from django.utils.http import url_has_allowed_host_and_scheme
 from django.utils.translation import gettext_lazy as _
 from django.contrib import auth
 
@@ -29,14 +31,12 @@ def authentication_login(request):
     elif referrer.startswith("http:/") and not referrer.startswith("http://"):
         referrer = "http://" + referrer[len("http:/") :]
 
-    host = (
-        "https://%s" % request.get_host()
-        if (request.is_secure())
-        else "http://%s" % request.get_host()
-    )
-    if not referrer.startswith(("/", host)):
+    if not url_has_allowed_host_and_scheme(
+        referrer,
+        allowed_hosts={request.get_host()},
+        require_https=request.is_secure(),
+    ):
         raise SuspiciousOperation("referrer is not internal")
-    iframe_param = "is_iframe=true&" if (request.GET.get("is_iframe")) else ""
     if request.user.is_authenticated:
         return redirect(referrer)
     if USE_CAS or USE_SHIB or USE_OIDC:
@@ -55,7 +55,11 @@ def authentication_login(request):
         )
     else:
         url = reverse("local-login")
-        url += "?%snext=%s" % (iframe_param, referrer.replace("&", "%26"))
+        query = QueryDict(mutable=True)
+        if request.GET.get("is_iframe"):
+            query["is_iframe"] = "true"
+        query["next"] = referrer
+        url += "?" + query.urlencode(safe="/")
         return redirect(url)
 
 

pod/completion/static/js/caption_maker.js

@@ -1408,7 +1408,8 @@ function processProxyVttResponse(obj) {
  * @returns stripped line
  */
 function stripHtmlTags(line) {
-  return String(line).replace(/[<>]/g, "").trim();
+  const cue = new VTTCue(0, 1, String(line));
+  return (cue.getCueAsHTML().textContent || "").trim();
 }
 
 /**

pod/cut/tests/test_views.py

@@ -3,6 +3,7 @@
 from django.test import TestCase, override_settings
 from django.contrib.auth.models import User
 from pod.cut.models import CutVideo
+from pod.video import forms as video_forms
 from pod.video.models import Video, Type
 from django.urls import reverse
 from pod.main.models import Configuration
@@ -11,6 +12,7 @@
 from django.utils.translation import gettext_lazy as _
 from .. import views
 from importlib import reload
+from unittest.mock import patch
 
 # ggignore-start
 # gitguardian:ignore
@@ -95,10 +97,12 @@ def test_post_cut_valid_form(self) -> None:
             "duration": 10,
         }
 
-        response = self.client.post(
-            reverse("cut:video_cut", kwargs={"slug": self.video.slug}), data=post_data
-        )
+        with patch.object(video_forms.encode, video_forms.ENCODE_VIDEO) as start_encode:
+            response = self.client.post(
+                reverse("cut:video_cut", kwargs={"slug": self.video.slug}), data=post_data
+            )
 
+        start_encode.assert_called_once_with(self.video.id)
         self.assertTrue(CutVideo.objects.filter(video=self.video).exists())
         self.assertRedirects(response, reverse("video:dashboard"))
         messages = [m.message for m in get_messages(response.wsgi_request)]

pod/duplicate/tests/test_views.py

@@ -1,8 +1,14 @@
 """Unit tests for Duplicate views."""
 
-from django.test import TestCase
+from datetime import date
+from tempfile import TemporaryDirectory
+from unittest.mock import patch
+
+from django.core.files.base import ContentFile
+from django.test import TestCase, override_settings
 from django.urls import reverse
 from django.contrib.auth.models import User
+from pod.video import forms as video_forms
 from pod.video.models import Video, Type
 
 # ggignore-start
@@ -20,20 +26,25 @@ class VideoDuplicateViewTest(TestCase):
 
     def setUp(self) -> None:
         """Set up required objects for the tests."""
+        media_dir = TemporaryDirectory()
+        self.addCleanup(media_dir.cleanup)
+        media_settings = override_settings(MEDIA_ROOT=media_dir.name)
+        media_settings.enable()
+        self.addCleanup(media_settings.disable)
         self.user = User.objects.create_user(
             username="testuser", password=PWD, is_staff=True
         )
         self.type = Type.objects.create(title="Test Type")
         self.video = Video.objects.create(
             title="Original Video",
-            video="test.mp4",
+            video=ContentFile(b"source video content", name="test.mp4"),
             slug="original-video",
             type=self.type,
             owner=self.user,
             description="Original description",
             description_fr="Description originale",
             description_en="Original description",
-            date_evt="2023-01-01",
+            date_evt=date(2023, 1, 1),
             main_lang="en",
             licence="CC BY-SA",
             is_draft=False,
@@ -42,16 +53,20 @@ def setUp(self) -> None:
             is_360=False,
             disable_comment=False,
         )
-        self.video.save()
 
     def test_video_duplicate(self) -> None:
         """Test duplicating a video."""
         self.client.force_login(self.user)
         url = reverse("duplicate:video_duplicate", args=[self.video.slug])
-        response = self.client.get(url)
+        with patch.object(video_forms.encode, video_forms.ENCODE_VIDEO) as start_encode:
+            response = self.client.get(url)
 
         # Check that the duplicated video exists
         duplicated_video = Video.objects.get(slug="0002-copy-of-original-video")
+        start_encode.assert_called_once_with(duplicated_video.id)
+        self.assertNotEqual(duplicated_video.video.name, self.video.video.name)
+        with duplicated_video.video.open("rb") as copied_file:
+            self.assertEqual(copied_file.read(), b"source video content")
         self.assertEqual(duplicated_video.title, "Copy of Original Video")
         self.assertEqual(duplicated_video.type, self.type)
         self.assertEqual(duplicated_video.owner, self.user)
@@ -67,8 +82,9 @@ def test_video_duplicate(self) -> None:
         self.assertEqual(duplicated_video.is_360, False)
         self.assertEqual(duplicated_video.disable_comment, False)
 
-        # Check the response status code
-        self.assertEqual(
-            response.status_code, 302
-        )  # Redirect after successful duplication"
+        self.assertRedirects(
+            response,
+            reverse("video:video_edit", args=[duplicated_video.slug]),
+            fetch_redirect_response=False,
+        )
         print(" --->  test_video_duplicate ok")

pod/enrichment/tests/test_views.py

@@ -6,7 +6,7 @@
 from django.contrib.auth import authenticate
 from django.contrib.auth.models import User
 from django.urls import reverse
-from pod.playlist.models import Playlist
+from pod.playlist.models import Playlist, PlaylistContent
 from pod.video.models import Video, Type
 from ..models import Enrichment
 from django.contrib.sites.models import Site
@@ -203,8 +203,9 @@ def test_invalid_video_slug(self):
         self.assertEqual(response.status_code, 400)
 
     def test_private_playlist_access(self):
-        """Test if a random user can't access to a private playlist."""
+        """Distinguish missing membership from denied access to a private playlist."""
         self.client.force_login(self.student)
+        Video.objects.filter(pk=self.video.pk).update(is_draft=False)
         playlist = Playlist.objects.create(
             name="Private playlist",
             visibility="private",
@@ -215,4 +216,7 @@ def test_private_playlist_access(self):
             + f"?playlist={playlist.slug}"
         )
         response = self.client.get(url)
+        self.assertEqual(response.status_code, 404)
+        PlaylistContent.objects.create(playlist=playlist, video=self.video)
+        response = self.client.get(url)
         self.assertEqual(response.status_code, 403)