Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def _create_answer(session, answer_dict) -> Answer:
survey_node_id = answer_dict['survey_node_id']
error = exc.BadRequest('survey_node not found: {}'.format(survey_node_id))
survey_node = get_model(session, SurveyNode, survey_node_id, error)
answer_dict['survey_node'] = survey_node
return construct_answer(**answer_dict)
KeyError, ValueError, TypeError, AttributeError,
SQLAlchemyError, DokomoError
)
if isinstance(err, tornado.web.HTTPError):
restless_error = exc.HttpError(err.log_message)
restless_error.status = err.status_code
err = restless_error
elif isinstance(err, SurveyAccessForbidden):
restless_error = exc.HttpError(str(err))
restless_error.status = 403
err = restless_error
elif isinstance(err, NoResultFound):
err = exc.NotFound()
elif isinstance(err, understood):
err = exc.BadRequest(err)
logging.exception(err)
return super().handle_error(err)
def _create_submission(self, survey):
# Unauthenticated submissions are only allowed if the survey_type is
# 'public'.
authenticated = super(self.__class__, self).is_authenticated()
if not authenticated:
if survey.survey_type == 'public':
self._check_xsrf_cookie()
else:
raise exc.Unauthorized()
# If logged in, add enumerator
if self.current_user_model is not None:
try:
enumerator = self._get_model(
self.data['enumerator_user_id'], model_cls=User
)
except KeyError:
self.data['enumerator'] = self.current_user_model
else:
self.data['enumerator'] = enumerator
self.data['survey'] = survey
with self.session.begin():
# create a list of Answer models
def detail(self, survey_id):
"""Return the given survey.
Public surveys don't require authentication.
Enumerator-only surveys do required authentication, and the user must
be one of the survey's enumerators or an administrator.
"""
result = super().detail(survey_id)
survey = self.session.query(Survey).get(survey_id)
if survey.survey_type == 'public':
return result
authenticated = super().is_authenticated(admin_only=False)
if not authenticated:
raise exc.Unauthorized()
user = self.current_user_model
if user.role == 'administrator':
return result
if user not in survey.enumerators:
raise SurveyAccessForbidden(survey.id)
return result
def create(self):
"""Create a new submission.
Uses the current_user_model (i.e. logged-in user) as creator.
"""
survey_id = self.data.pop('survey_id')
error = exc.BadRequest(
'The survey could not be found: {}'.format(survey_id)
)
survey = self._get_model(survey_id, model_cls=Survey, exception=error)
return _create_submission(self, survey)
def handle_error(self, err):
"""Generate a serialized error message.
If the error came from Tornado, pass it along as such.
Otherwise, turn certain expected errors into 400 BAD REQUEST instead
of 500 INTERNAL SERVER ERROR.
"""
understood = (
KeyError, ValueError, TypeError, AttributeError,
SQLAlchemyError, DokomoError
)
if isinstance(err, tornado.web.HTTPError):
restless_error = exc.HttpError(err.log_message)
restless_error.status = err.status_code
err = restless_error
elif isinstance(err, SurveyAccessForbidden):
restless_error = exc.HttpError(str(err))
restless_error.status = 403
err = restless_error
elif isinstance(err, NoResultFound):
err = exc.NotFound()
elif isinstance(err, understood):
err = exc.BadRequest(err)
logging.exception(err)
return super().handle_error(err)