From 4f7da8bfa4e513431c6fcf2f3e8fdbe90a50b370 Mon Sep 17 00:00:00 2001
From: Emmanuel Viennet <emmanuel.viennet@gmail.com>
Date: Thu, 25 Jan 2024 22:40:10 +0100
Subject: [PATCH] =?UTF-8?q?Tag=20modules=20formation:=20v=C3=A9rification?=
 =?UTF-8?q?=20longueur=20et=20syntaxe?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/scodoc/sco_tag_module.py       | 31 +++++++++++++++++++++++-------
 app/static/js/module_tag_editor.js |  2 ++
 2 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/app/scodoc/sco_tag_module.py b/app/scodoc/sco_tag_module.py
index 2f51e383e..051037618 100644
--- a/app/scodoc/sco_tag_module.py
+++ b/app/scodoc/sco_tag_module.py
@@ -34,8 +34,9 @@
    Pour l'UI, voir https://goodies.pixabay.com/jquery/tag-editor/demo.html
 """
 import http
+import re
 
-from flask import g, url_for
+from flask import g
 
 from app.comp import res_sem
 from app.comp.res_compat import NotesTableCompat
@@ -43,11 +44,9 @@ from app.models import FormSemestre
 import app.scodoc.sco_utils as scu
 import app.scodoc.notesdb as ndb
 from app import log
-from app.scodoc import sco_cache
 from app.scodoc import sco_edit_module
 from app.scodoc import sco_etud
-from app.scodoc.sco_exceptions import ScoValueError, AccessDenied
-from app.scodoc.sco_permissions import Permission
+from app.scodoc.sco_exceptions import ScoValueError
 
 # Opérations à implementer:
 #  + liste des modules des formations de code donné (formation_code) avec ce tag
@@ -100,6 +99,17 @@ class ScoTag(object):
     def __repr__(self):  # debug
         return '<tag "%s">' % self.title
 
+    @classmethod
+    def check_tag_title(cls, title: str) -> bool:
+        """ "true si le tag est acceptable: longueur max (32), syntaxe
+        un_tag  ou un_tag:78
+        """
+        if not title or len(title) > 32:
+            return False
+        if re.match(r"^[A-Za-z0-9\-_$!\.]*(:[0-9]*)?$", title):
+            return True
+        return False
+
     def delete(self):
         """Delete this tag.
         This object should not be used after this call !
@@ -243,10 +253,17 @@ def module_tag_set(module_id="", taglist=None):
     elif isinstance(taglist, str):
         taglist = taglist.split(",")
     taglist = [t.strip() for t in taglist]
-    log("module_tag_set: module_id=%s taglist=%s" % (module_id, taglist))
+    log(f"module_tag_set: module_id={module_id} taglist={taglist}")
+    # Check tags syntax
+    for tag in taglist:
+        if not ScoTag.check_tag_title(tag):
+            return scu.json_error(404, "invalid tag")
+
+    # TODO code à moderniser (+ revoir classe ScoTag, utiliser modèle)
+
     # Sanity check:
-    Mod = sco_edit_module.module_list(args={"module_id": module_id})
-    if not Mod:
+    mod_dict = sco_edit_module.module_list(args={"module_id": module_id})
+    if not mod_dict:
         raise ScoValueError("invalid module !")
 
     newtags = set(taglist)
diff --git a/app/static/js/module_tag_editor.js b/app/static/js/module_tag_editor.js
index 9aff530a6..e7927fa7a 100644
--- a/app/static/js/module_tag_editor.js
+++ b/app/static/js/module_tag_editor.js
@@ -9,6 +9,8 @@ $(function () {
       $.post("module_tag_set", {
         module_id: field.data("module_id"),
         taglist: tags.join(),
+      }).fail(function(jqXHR, textStatus, errorThrown) {
+        alert("erreur: tag non enregistré");
       });
     },
     autocomplete: {