review app - permission and validation hardening

review/models/review_models.py

@@ -133,7 +133,7 @@ def source_object(self) -> 'ReviewableModelMixin':
         # or by us directly going through the
         foreign_sets = [m for m in dir(self) if m.endswith('_set') and not m.startswith('reviews')]
         for foreign_set in foreign_sets:
-            source_object = getattr(self, foreign_set).first()
+            source_object = getattr(self, foreign_set).order_by('pk').first()
             if source_object:
                 return source_object
 

review/templates/review/review.html

@@ -23,7 +23,7 @@
 {% block content %}
     <div class="container">
         <form method="post">
-            {% csrf_token action="{{ request.path }}" %}
+            {% csrf_token %}
 
             {% if not review.pk %}<h4>Step 1 of 2</h4>{% endif %}
 

review/views/review_views.py

@@ -131,7 +131,9 @@ def _handle_review(request, review: Review, reviewing: Optional[ReviewableModelM
     else:
         initial = {}
         if not review.pk:
-            initial["reviewing_labs"] = {UserSettings.get_for_user(request.user).default_lab}
+            default_lab = UserSettings.get_for_user(request.user).default_lab
+            if default_lab in review.reviewing.source_object.reviewing_labs:
+                initial["reviewing_labs"] = {default_lab}
         discussion_form = ReviewForm(review=review, initial=initial)
 
     return render(request, 'review/review.html', {
@@ -144,9 +146,9 @@ def _handle_review(request, review: Review, reviewing: Optional[ReviewableModelM
 
 def new_review(request, reviewed_object_id: int, topic_id: str):
     reviewed_object = ReviewedObject.objects.get(pk=reviewed_object_id)
-
     topic = ReviewTopic.objects.get(pk=topic_id)
     review = reviewed_object.new_review(topic=topic, user=request.user)
+    review.check_can_view(request.user)
 
     return _handle_review(request=request, review=review, reviewing=reviewed_object)
 

review/widgets/multi_lab_selector.py

@@ -1,5 +1,7 @@
 from typing import Iterable, Any
 
+from django.core.exceptions import ValidationError
+
 from snpdb.models import Lab
 from uicore.widgets.radio_other_widget import MultiChoiceFieldWithOther, CheckboxOtherWidget
 
@@ -20,5 +22,11 @@ def __init__(self, labs: Iterable[Lab], initial: Any = None):
 
     def to_python(self, value):
         if isinstance(value, (set, list, tuple)):
-            return [self.labs[int(v)] for v in value]
+            result = []
+            for v in value:
+                try:
+                    result.append(self.labs[int(v)])
+                except (KeyError, ValueError):
+                    raise ValidationError("Invalid lab selection.")
+            return result
         return []