Add attachment validator when uploading attachment to tickets

Makefile

@@ -95,6 +95,11 @@ demo:
 .PHONY: rundemo
 rundemo: demo
 	demodesk runserver 8080
+	
+#: migrations - Create Django migrations for this project.
+.PHONY: migrations
+migrations: demo
+	    demodesk makemigrations
 
 
 #: release - Tag and push to PyPI.

demo/README.rst

@@ -59,7 +59,8 @@ before running:
 
 *NOTE ON DJANGO VERISON*
 
-The demo project was configured with Django 2.x in mind.
+The demo project was configured with Django 2.2+ in mind.
+Django 3.2 LTS is highly recommended.
 Django 1.11 is NOT supported.
 
 *NOTE ON ATTACHMENTS*

demo/demodesk/manage.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+import os
+import sys
+
+def main():
+    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "demodesk.config.settings")
+    try:
+        from django.core.management import execute_from_command_line
+    except ImportError:
+        # The above import may fail for some other reason. Ensure that the
+        # issue is really that Django is missing to avoid masking other
+        # exceptions on Python 2.
+        try:
+            import django
+        except ImportError:
+            raise ImportError(
+                "Couldn't import Django. Are you sure it's installed and "
+                "available on your PYTHONPATH environment variable? Did you "
+                "forget to activate a virtual environment?"
+            )
+        raise
+    execute_from_command_line(sys.argv)
+
+if __name__ == "__main__":
+    main()

demo/setup.py

@@ -13,7 +13,7 @@ project_root = os.path.dirname(here)
 NAME = 'django-helpdesk-demodesk'
 DESCRIPTION = 'A demo Django project using django-helpdesk'
 README = open(os.path.join(here, 'README.rst')).read()
-VERSION = '0.3.0b4'
+VERSION = '0.3.0b5'
 #VERSION = open(os.path.join(project_root, 'VERSION')).read().strip()
 AUTHOR = 'django-helpdesk team'
 URL = 'https://github.com/django-helpdesk/django-helpdesk'
@@ -22,6 +22,7 @@ CLASSIFIERS = ['Development Status :: 4 - Beta',
                'Programming Language :: Python :: 3.6',
                'Programming Language :: Python :: 3.7',
                'Programming Language :: Python :: 3.8',
+               'Programming Language :: Python :: 3.9',
                'Framework :: Django :: 2.2',
                'Framework :: Django :: 3.0',
                'Framework :: Django :: 3.1',

helpdesk/forms.py

@@ -223,7 +223,7 @@ class AbstractTicketForm(CustomFieldMixin, forms.Form):
         widget=forms.FileInput(attrs={'class': 'form-control-file'}),
         required=False,
         label=_('Attach File'),
-        help_text=_('You can attach a file such as a document or screenshot to this ticket.'),
+        help_text=_('You can attach a file to this ticket. Only file types such as plain text (.txt), a document (.pdf, .docx, or .odt), or screenshot (.png or .jpg) may be uploaded.'),
     )
 
     class Media:

helpdesk/migrations/0036_add_attachment_validator.py

@@ -0,0 +1,25 @@
+# Generated by Django 3.2.7 on 2021-10-05 10:21
+
+from django.db import migrations, models
+import helpdesk.models
+import helpdesk.validators
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('helpdesk', '0035_alter_email_on_ticket_change'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='followupattachment',
+            name='file',
+            field=models.FileField(max_length=1000, upload_to=helpdesk.models.attachment_path, validators=[helpdesk.validators.validate_file_extension], verbose_name='File'),
+        ),
+        migrations.AlterField(
+            model_name='kbiattachment',
+            name='file',
+            field=models.FileField(max_length=1000, upload_to=helpdesk.models.attachment_path, validators=[helpdesk.validators.validate_file_extension], verbose_name='File'),
+        ),
+    ]

helpdesk/models.py

@@ -30,6 +30,8 @@ import uuid
 
 from helpdesk import settings as helpdesk_settings
 
+from .validators import validate_file_extension
+
 from .templated_email import send_templated_mail
 
 
@@ -1022,6 +1024,7 @@ class Attachment(models.Model):
         _('File'),
         upload_to=attachment_path,
         max_length=1000,
+        validators=[validate_file_extension]
     )
 
     filename = models.CharField(

helpdesk/validators.py

@@ -0,0 +1,15 @@
+# validators.py
+#
+# validators for file uploads, etc.
+
+
+
+def validate_file_extension(value):
+    import os
+    from django.core.exceptions import ValidationError
+    ext = os.path.splitext(value.name)[1]  # [0] returns path+filename
+    valid_extensions = ['.txt', '.pdf', '.doc', '.docx', '.odt', '.jpg', '.png']
+    # TODO: we might improve this with more thorough checks of file types
+    # rather than just the extensions.
+    if not ext.lower() in valid_extensions:
+        raise ValidationError('Unsupported file extension.')

helpdesk/views/staff.py

@@ -22,6 +22,7 @@ from django.shortcuts import render, get_object_or_404, redirect
 from django.utils.translation import ugettext as _
 from django.utils.html import escape
 from django.utils import timezone
+from django.views.decorators.csrf import requires_csrf_token
 from django.views.generic.edit import FormView, UpdateView
 
 from helpdesk.forms import CUSTOMFIELD_DATE_FORMAT

setup.py

@@ -6,7 +6,7 @@ from distutils.util import convert_path
 from fnmatch import fnmatchcase
 from setuptools import setup, find_packages
 
-version = '0.3.0b4'
+version = '0.3.0b5'
 
 # Provided as an attribute, so you can append to these instead
 # of replicating them:
@@ -129,6 +129,7 @@ setup(
         "Programming Language :: Python :: 3.6",
         "Programming Language :: Python :: 3.7",
         "Programming Language :: Python :: 3.8",
+        "Programming Language :: Python :: 3.9",
         "Framework :: Django",
         'Framework :: Django :: 2.2',
         "Framework :: Django :: 3.0",