admin: allow * in group names, verify that only valid group names, section urls and post urls are saved

jdav_web/jdav_web/settings/components/base.py

@@ -191,3 +191,6 @@ MARKDOWNIFY = {
         }
     }
 }
+
+# allowed characters in names appearing in urls on the website
+STARTPAGE_URL_NAME_PATTERN = "[\w\-: *]"

jdav_web/members/admin.py

@@ -704,6 +704,10 @@ class RegistrationPasswordInline(admin.TabularInline):
 
 
 class GroupAdminForm(forms.ModelForm):
+    name = forms.RegexField(regex=r'^{pattern}+$'.format(pattern=settings.STARTPAGE_URL_NAME_PATTERN),
+                            label=_('name'),
+                            error_messages={'invalid': _('The group name may only consist of letters, numerals, _, -, :, * and spaces.')})
+
     class Meta:
         model = Freizeit
         exclude = ['add_member']

jdav_web/startpage/admin.py

@@ -1,4 +1,7 @@
 from django.contrib import admin
+from django.conf import settings
+from django import forms
+from django.utils.translation import gettext_lazy as _
 
 from .models import Post, Image, Section, MemberOnPost
 
@@ -13,14 +16,27 @@ class MemberOnPostInline(admin.TabularInline):
     extra = 0
 
 
+class PostForm(forms.ModelForm):
+    urlname = forms.RegexField(regex=r'^{pattern}+$'.format(pattern=settings.STARTPAGE_URL_NAME_PATTERN),
+                               label=_('URL'),
+                               error_messages={'invalid': _('The url may only consist of letters, numerals, _, -, :, * and spaces.')})
+
+
 @admin.register(Post)
 class PostAdmin(admin.ModelAdmin):
     inlines = [ImageInline, MemberOnPostInline]
     list_display = ['title', 'date', 'section', 'absolute_urlname']
     list_filter = ['section']
     search_fields = ['title']
+    form = PostForm
+
 
+class SectionForm(forms.ModelForm):
+    urlname = forms.RegexField(regex=r'^{pattern}+$'.format(pattern=settings.STARTPAGE_URL_NAME_PATTERN),
+                               label=_('URL'),
+                               error_messages={'invalid': _('The url may only consist of letters, numerals, _, -, :, * and spaces.')})
 
 @admin.register(Section)
 class SectionAdmin(admin.ModelAdmin):
     list_display = ['title', 'absolute_urlname']
+    form = SectionForm

jdav_web/startpage/locale/de/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-12-01 16:23+0100\n"
+"POT-Creation-Date: 2024-12-04 00:04+0100\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -18,14 +18,21 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 
+#: startpage/admin.py:21 startpage/admin.py:36 startpage/models.py:18
+#: startpage/models.py:40
+msgid "URL"
+msgstr "URL"
+
+#: startpage/admin.py:22 startpage/admin.py:37
+msgid "The url may only consist of letters, numerals, _, -, :, * and spaces."
+msgstr ""
+"Die URL darf nur aus Buchstaben, Zahlen, _, -, :, * oder Leerzeichen "
+"bestehen."
+
 #: startpage/models.py:17 startpage/models.py:39
 msgid "Title"
 msgstr "Titel"
 
-#: startpage/models.py:18 startpage/models.py:40
-msgid "URL"
-msgstr "URL"
-
 #: startpage/models.py:19 startpage/models.py:42
 msgid "website text"
 msgstr "Webseitentext"

jdav_web/startpage/urls.py

@@ -1,3 +1,4 @@
+from django.conf import settings
 from django.urls import re_path
 
 from . import views
@@ -10,7 +11,10 @@ urlpatterns = [
     re_path(r'^berichte/?$', views.berichte, name='berichte'),
     re_path(r'^gruppen/?$', views.static_view('startpage/gruppen.html'), name='gruppen'),
     re_path(r'^gruppen/faq/?$', views.static_view('startpage/gruppen/faq.html'), name='faq'),
-    re_path(r'^gruppen/(?P<group_name>[\w\-:]+)/?$', views.gruppe_detail, name='gruppe_detail'),
+    re_path(r'^gruppen/(?P<group_name>{pattern}+)/?$'.format(pattern=settings.STARTPAGE_URL_NAME_PATTERN),
-    re_path(r'^(?P<section_name>[\w\-:]+)/(?P<post_name>[\w\-:]+)/?$', views.post, name='post'),
+            views.gruppe_detail, name='gruppe_detail'),
-    re_path(r'^(?P<section_name>[\w\-:]+)/?$', views.section, name='section'),
+    re_path(r'^(?P<section_name>{pattern}+)/(?P<post_name>{pattern}+)/?$'.format(pattern=settings.STARTPAGE_URL_NAME_PATTERN),
+            views.post, name='post'),
+    re_path(r'^(?P<section_name>{pattern}+)/?$'.format(pattern=settings.STARTPAGE_URL_NAME_PATTERN),
+            views.section, name='section'),
 ]