+ $("#reloadMessagesButton").click()
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {% trans "Deleting the record" %} '{{delete_object}}' {% trans "would require managing the following related objects:" %}
+
+
+ {% trans "Protected Records" %} ({{protected|length}})
+
+
+ {% for summary in protected_objects_count.items %}
+ - {{summary.0|capfirst}} : {{summary.1|capfirst}}
+ {% endfor %}
+
+
+ {% trans "Other Related Records" %} ({{model_count_sum}})
+
+
+ {% for summary in related_objects_count.items %}
+ - {{summary.0|capfirst}} : {{summary.1|capfirst}}
+ {% endfor %}
+
+
+
+
+
+ {% for key in model_map.keys %}
+
+ {% endfor %}
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/horilla_views/templatetags/generic_template_filters.py b/horilla_views/templatetags/generic_template_filters.py
index 3635755be..dc039b109 100644
--- a/horilla_views/templatetags/generic_template_filters.py
+++ b/horilla_views/templatetags/generic_template_filters.py
@@ -139,3 +139,11 @@ def get_item(dictionary: dict, key: str):
if dictionary:
return dictionary.get(key, "")
return ""
+
+
+@register.filter("get_id")
+def get_id(string: str):
+ """
+ Generate target/id for the generic delete summary
+ """
+ return string.split("-")[0].lower().replace(" ", "")
diff --git a/horilla_views/urls.py b/horilla_views/urls.py
index 3094592ff..074ba816f 100644
--- a/horilla_views/urls.py
+++ b/horilla_views/urls.py
@@ -39,4 +39,9 @@ urlpatterns = [
views.LastAppliedFilter.as_view(),
name="last-applied-filter",
),
+ path(
+ "generic-delete",
+ views.HorillaDeleteConfirmationView.as_view(),
+ name="generic-delete",
+ ),
]
diff --git a/horilla_views/views.py b/horilla_views/views.py
index 9c0257b5e..5b0e939aa 100644
--- a/horilla_views/views.py
+++ b/horilla_views/views.py
@@ -1,18 +1,23 @@
import importlib
+from collections import defaultdict
from django import forms
+from django.apps import apps
from django.contrib import messages
+from django.contrib.admin.utils import NestedObjects
from django.core.cache import cache as CACHE
+from django.db import router
from django.http import HttpResponse, JsonResponse
from django.shortcuts import render
from django.utils.decorators import method_decorator
from django.views import View
from django.views.decorators.csrf import csrf_protect
+from base.methods import eval_validate
from horilla_views import models
-from horilla_views.cbv_methods import get_short_uuid, login_required
+from horilla_views.cbv_methods import get_short_uuid, login_required, merge_dicts
from horilla_views.forms import SavedFilterForm
-from horilla_views.generic.cbv.views import HorillaFormView
+from horilla_views.generic.cbv.views import HorillaFormView, HorillaListView
# Create your views here.
@@ -93,7 +98,7 @@ class ReloadField(View):
)
dynamic_initial = request.GET.get("dynamic_initial", [])
parent_form.fields[cache_field].widget.attrs = field.widget.attrs
- parent_form.fields[cache_field].initial = eval(
+ parent_form.fields[cache_field].initial = eval_validate(
f"""[{dynamic_cache["value"]},{dynamic_initial}]"""
)
@@ -258,3 +263,302 @@ class LastAppliedFilter(View):
timeout=600,
)
return HttpResponse("success")
+
+
+class DynamiListView(HorillaListView):
+ """
+ DynamicListView for Generic Delete
+ """
+
+ instances = []
+
+ def get_queryset(self):
+ search = self.request.GET.get("search", "")
+
+ def _search_filter(instance):
+ return search in str(instance).lower()
+
+ return filter(_search_filter, self.instances)
+
+
+class HorillaDeleteConfirmationView(View):
+ """
+ Generic Delete Confirmation View
+ """
+
+ confirmation_target = "deleteConfirmationBody"
+
+ def get(self, *args, **kwargs):
+ """
+ GET method
+ """
+ from horilla.urls import path, urlpatterns
+
+ pk = self.request.GET["pk"]
+
+ app, MODEL_NAME = self.request.GET["model"].split(".")
+ if not self.request.user.has_perm(app + ".delete_" + MODEL_NAME.lower()):
+ return render(self.request, "no_perm.html")
+ model = apps.get_model(app, MODEL_NAME)
+
+ delete_object = model.objects.get(pk=pk)
+ objs = [delete_object]
+ using = router.db_for_write(delete_object._meta.model)
+ collector = NestedObjects(using=using, origin=objs)
+ collector.collect(objs)
+ MODEL_MAP = {}
+ PROTECTED_MODEL_MAP = {}
+ DYNAMIC_PATH_MAP = {}
+ MODEL_RELATED_FIELD_MAP = {}
+ MODEL_RELATED_PROTECTED_FIELD_MAP = {}
+
+ def format_callback(instance, protected=False):
+ if not MODEL_RELATED_FIELD_MAP.get(instance._meta.model):
+ MODEL_RELATED_FIELD_MAP[instance._meta.model] = []
+ MODEL_RELATED_PROTECTED_FIELD_MAP[instance._meta.model] = []
+
+ def find_related_field(obj, related_instance):
+ for field in obj._meta.get_fields():
+ # Check if the field is a foreign key (or related model)
+ if isinstance(
+ field, (models.models.ForeignKey, models.models.OneToOneField)
+ ):
+ # Get the field value
+ field_value = getattr(obj, field.name)
+ # If the field value matches the related instance, return the field name
+ if field_value == related_instance:
+ if "PROTECT" in field.remote_field.on_delete.__name__:
+ MODEL_RELATED_PROTECTED_FIELD_MAP[
+ instance._meta.model
+ ].append((field.name, field.verbose_name))
+ MODEL_RELATED_FIELD_MAP[instance._meta.model].append(
+ field.name
+ )
+
+ find_related_field(instance, delete_object)
+ app_label = instance._meta.app_label
+ app_label = apps.get_app_config(app_label).verbose_name
+ model = instance._meta.model
+
+ model.verbose_name = model.__name__.split("_")[0]
+
+ model_map = PROTECTED_MODEL_MAP if protected else MODEL_MAP
+
+ if app_label not in model_map:
+ model_map[app_label] = {}
+
+ if model not in model_map[app_label]:
+ model_map[app_label][model] = []
+ DYNAMIC_PATH_MAP[model.verbose_name] = (
+ f"{get_short_uuid(prefix='generic-delete',length=10)}"
+ )
+
+ class DynamiListView(HorillaListView):
+ """
+ DynamicListView for Generic Delete
+ """
+
+ instances = []
+ columns = [
+ (
+ "Record",
+ "dynamic_display_name_generic_delete",
+ ),
+ ]
+ records_per_page = 5
+
+ selected_instances_key_id = "storedIds" + app_label
+
+ def dynamic_display_name_generic_delete(self):
+
+ is_protected = False
+ classname = self.__class__.__name__
+ app_label = self._meta.app_label
+
+ app_verbose_name = apps.get_app_config(app_label).verbose_name
+ protected = PROTECTED_MODEL_MAP.get(app_verbose_name, {}).get(
+ self._meta.model, []
+ )
+ ids = [instance.pk for instance in protected]
+ if self.pk in ids:
+ is_protected = True
+
+ if "_" in classname:
+ field_name = classname.split("_", 1)[1]
+ classname = classname.split("_")[0]
+
+ object_field_name = classname.lower()
+ model = apps.get_model(app_label, classname)
+
+ field = model._meta.get_field(field_name)
+
+ return f"""
+ {getattr(self, object_field_name)}
+
(In {field.verbose_name})
+ """
+ indication = f"""
+ {self}
+ """
+ if is_protected:
+ verbose_names = [
+ str(i[1])
+ for i in list(
+ set(
+ MODEL_RELATED_PROTECTED_FIELD_MAP.get(
+ self._meta.model, ""
+ )
+ )
+ )
+ ]
+ indication = (
+ indication
+ + f"""
+
(Record in {",".join(verbose_names)})
+ """
+ )
+ return indication
+
+ def __init__(self, **kwargs):
+ super().__init__(**kwargs)
+ self._saved_filters = self.request.GET
+
+ def get_context_data(self, **kwargs):
+ context = super().get_context_data(**kwargs)
+ context["search_url"] = "/" + self.search_url
+ return context
+
+ def get_queryset(self):
+ search = self.request.GET.get("search", "")
+
+ def _search_filter(instance):
+ return search in str(instance).lower()
+
+ self.instances = list(
+ set(
+ (
+ self.instances
+ + MODEL_MAP.get(
+ apps.get_app_config(
+ self.model._meta.app_label
+ ).verbose_name,
+ {},
+ ).get(self.model, [])
+ + PROTECTED_MODEL_MAP.get(
+ apps.get_app_config(
+ self.model._meta.app_label
+ ).verbose_name,
+ {},
+ ).get(self.model, [])
+ )
+ )
+ )
+
+ queryset = self.model.objects.filter(
+ pk__in=[
+ instance.pk
+ for instance in filter(_search_filter, self.instances)
+ ]
+ )
+ return queryset
+
+ model.dynamic_display_name_generic_delete = (
+ DynamiListView.dynamic_display_name_generic_delete
+ )
+
+ DynamiListView.model = model
+ if "_" in model.__name__:
+ DynamiListView.bulk_update_fields = [MODEL_NAME.lower()]
+ else:
+ DynamiListView.bulk_update_fields = MODEL_RELATED_FIELD_MAP.get(
+ model, []
+ )
+ DynamiListView.instances = model_map[app_label][model]
+ DynamiListView.search_url = DYNAMIC_PATH_MAP[model.verbose_name]
+ DynamiListView.selected_instances_key_id = (
+ DynamiListView.selected_instances_key_id + model.verbose_name
+ )
+
+ urlpatterns.append(
+ path(
+ DynamiListView.search_url,
+ DynamiListView.as_view(),
+ name=DynamiListView.search_url,
+ )
+ )
+ model_map[app_label][model].append(instance)
+
+ return instance
+
+ _to_delete = collector.nested(format_callback)
+ protected = [
+ format_callback(obj, protected=True) for obj in collector.protected
+ ]
+
+ model_count = {
+ model._meta.verbose_name_plural: len(objs)
+ for model, objs in collector.model_objs.items()
+ }
+
+ protected_model_count = defaultdict(int)
+
+ for obj in collector.protected:
+ model = type(obj)
+ protected_model_count[model._meta.verbose_name_plural] += 1
+ protected_model_count = dict(protected_model_count)
+
+ return render(
+ self.request,
+ "generic/delete_confirmation.html",
+ {
+ "model_map": merge_dicts(MODEL_MAP, PROTECTED_MODEL_MAP),
+ "dynamic_list_path": DYNAMIC_PATH_MAP,
+ "delete_object": delete_object,
+ "protected": protected,
+ "model_count_sum": sum(model_count.values()),
+ "related_objects_count": model_count,
+ "protected_objects_count": protected_model_count,
+ }
+ | self.get_context_data(),
+ )
+
+ def post(self, *args, **kwargs):
+ """
+ Post method to handle the delete
+ """
+ pk = self.request.GET["pk"]
+ app, MODEL_NAME = self.request.GET["model"].split(".")
+ if not self.request.user.has_perm(app + ".delete_" + MODEL_NAME.lower()):
+ return render(self.request, "no_perm.html")
+ model = apps.get_model(app, MODEL_NAME)
+ delete_object = model.objects.get(pk=pk)
+ objs = [delete_object]
+ using = router.db_for_write(delete_object._meta.model)
+ collector = NestedObjects(using=using, origin=objs)
+ collector.collect(objs)
+
+ def delete_callback(instance, protected=False):
+ try:
+ instance.delete()
+ messages.success(self.request, f"Deleted {instance}")
+ except:
+ messages.error(self.request, f"Cannot delete : {instance}")
+
+ # deleting protected objects
+ for obj in collector.protected:
+ delete_callback(obj, protected=True)
+ # deleting related objects
+ collector.nested(delete_callback)
+
+ return HttpResponse(
+ """
+
+ """
+ )
+
+ def get_context_data(self, **kwargs) -> dict:
+ context = {}
+ context["confirmation_target"] = self.confirmation_target
+ return context
diff --git a/leave/views.py b/leave/views.py
index be82b3708..246f80bc7 100644
--- a/leave/views.py
+++ b/leave/views.py
@@ -27,6 +27,7 @@ from base.forms import PenaltyAccountForm
from base.methods import (
choosesubordinates,
closest_numbers,
+ eval_validate,
export_data,
filtersubordinates,
get_key_instances,
@@ -4736,7 +4737,7 @@ if apps.is_installed("attendance"):
comp_leave_req = CompensatoryLeaveRequest.objects.get(id=comp_leave_id)
context = {
"comp_leave_req": comp_leave_req,
- "my_request": eval(request.GET.get("my_request")),
+ "my_request": eval_validate(request.GET.get("my_request")),
"instances_ids": requests_ids_json,
"previous": previous_id,
"next": next_id,
diff --git a/offboarding/views.py b/offboarding/views.py
index ef533ea55..5a7a01772 100644
--- a/offboarding/views.py
+++ b/offboarding/views.py
@@ -11,8 +11,7 @@ from django.urls import reverse
from django.utils.translation import gettext_lazy as _
from base.context_processors import intial_notice_period
-from base.methods import closest_numbers, sortby
-from base.views import paginator_qry
+from base.methods import closest_numbers, eval_validate, paginator_qry, sortby
from employee.models import Employee
from horilla.decorators import (
hx_request_required,
@@ -178,7 +177,7 @@ def create_offboarding(request):
"""
Create offboarding view
"""
- instance_id = eval(str(request.GET.get("instance_id")))
+ instance_id = eval_validate(str(request.GET.get("instance_id")))
instance = None
if instance_id and isinstance(instance_id, int):
instance = Offboarding.objects.filter(id=instance_id).first()
@@ -236,7 +235,7 @@ def create_stage(request):
This method is used to create stages for offboardings
"""
offboarding_id = request.GET["offboarding_id"]
- instance_id = eval(str(request.GET.get("instance_id")))
+ instance_id = eval_validate(str(request.GET.get("instance_id")))
instance = None
if instance_id and isinstance(instance_id, int):
instance = OffboardingStage.objects.get(id=instance_id)
@@ -280,7 +279,7 @@ def add_employee(request):
)
end_date = datetime.today() + timedelta(days=default_notice_period)
stage_id = request.GET["stage_id"]
- instance_id = eval(str(request.GET.get("instance_id")))
+ instance_id = eval_validate(str(request.GET.get("instance_id")))
instance = None
if instance_id and isinstance(instance_id, int):
instance = OffboardingEmployee.objects.get(id=instance_id)
@@ -508,7 +507,7 @@ def add_task(request):
This method is used to add offboarding tasks
"""
stage_id = request.GET.get("stage_id")
- instance_id = eval(str(request.GET.get("instance_id")))
+ instance_id = eval_validate(str(request.GET.get("instance_id")))
employees = OffboardingEmployee.objects.filter(stage_id=stage_id)
instance = None
if instance_id:
@@ -807,7 +806,7 @@ def create_resignation_request(request):
"""
This method is used to render form to create resignation requests
"""
- instance_id = eval(str(request.GET.get("instance_id")))
+ instance_id = eval_validate(str(request.GET.get("instance_id")))
instance = None
if instance_id:
instance = ResignationLetter.objects.get(id=instance_id)
diff --git a/payroll/views/component_views.py b/payroll/views/component_views.py
index c47a5c2a3..25201a38f 100644
--- a/payroll/views/component_views.py
+++ b/payroll/views/component_views.py
@@ -29,6 +29,7 @@ import payroll.models.models
from base.backends import ConfiguredEmailBackend
from base.methods import (
closest_numbers,
+ eval_validate,
filter_own_records,
get_key_instances,
get_next_month_same_date,
@@ -1353,7 +1354,7 @@ def create_loan(request):
"""
This method is used to create and update the loan instance
"""
- instance_id = eval(str(request.GET.get("instance_id")))
+ instance_id = eval_validate(str(request.GET.get("instance_id")))
instance = LoanAccount.objects.filter(id=instance_id).first()
form = forms.LoanAccountForm(instance=instance)
if request.method == "POST":
@@ -1593,7 +1594,7 @@ def create_reimbursement(request):
"""
This method is used to create reimbursement
"""
- instance_id = eval(str(request.GET.get("instance_id")))
+ instance_id = eval_validate(str(request.GET.get("instance_id")))
instance = None
if instance_id:
instance = Reimbursement.objects.filter(id=instance_id).first()
@@ -1694,7 +1695,9 @@ def approve_reimbursements(request):
status = request.GET["status"]
if status == "canceled":
status = "rejected"
- amount = eval(request.GET.get("amount")) if request.GET.get("amount") else 0
+ amount = (
+ eval_validate(request.GET.get("amount")) if request.GET.get("amount") else 0
+ )
amount = max(0, amount)
reimbursements = Reimbursement.objects.filter(id__in=ids)
if status and len(status):
diff --git a/payroll/views/views.py b/payroll/views/views.py
index dfd35cb56..ed873ae04 100644
--- a/payroll/views/views.py
+++ b/payroll/views/views.py
@@ -21,6 +21,7 @@ from django.utils.translation import gettext_lazy as _
from base.methods import (
closest_numbers,
+ eval_validate,
export_data,
generate_colors,
generate_pdf,
@@ -188,7 +189,7 @@ def contract_status_update(request, contract_id):
@permission_required("payroll.change_contract")
def bulk_contract_status_update(request):
status = request.POST.get("status")
- ids = eval(request.POST.get("ids"))
+ ids = eval_validate(request.POST.get("ids"))
all_contracts = Contract.objects.all()
contracts = all_contracts.filter(id__in=ids)
@@ -1675,7 +1676,7 @@ def initial_notice_period(request):
"""
This method is used to set initial value notice period
"""
- notice_period = eval(request.GET["notice_period"])
+ notice_period = eval_validate(request.GET["notice_period"])
settings = PayrollGeneralSetting.objects.first()
settings = settings if settings else PayrollGeneralSetting()
settings.notice_period = max(notice_period, 0)
diff --git a/pms/views.py b/pms/views.py
index 638d94bf8..58c351d65 100644
--- a/pms/views.py
+++ b/pms/views.py
@@ -27,6 +27,7 @@ from django.utils.translation import gettext_lazy as _
from base.methods import (
closest_numbers,
+ eval_validate,
get_key_instances,
get_pagination,
paginator_qry,
@@ -3221,8 +3222,8 @@ def key_result_current_value_update(request):
This method is used to update keyresult current value
"""
try:
- current_value = eval(request.POST.get("current_value"))
- emp_kr_id = eval(request.POST.get("emp_key_result_id"))
+ current_value = eval_validate(request.POST.get("current_value"))
+ emp_kr_id = eval_validate(request.POST.get("emp_key_result_id"))
emp_kr = EmployeeKeyResult.objects.get(id=emp_kr_id)
if current_value <= emp_kr.target_value:
emp_kr.current_value = current_value
@@ -3309,7 +3310,7 @@ def create_meetings(request):
Post:
it will redirect to view_meetings.html .
"""
- instance_id = eval(str(request.GET.get("instance_id")))
+ instance_id = eval_validate(str(request.GET.get("instance_id")))
instance = None
initial = {"manager": request.user.employee_get, "employee_id": None}
if instance_id and isinstance(instance_id, int):
diff --git a/recruitment/views/views.py b/recruitment/views/views.py
index fb597519a..39aca26d2 100644
--- a/recruitment/views/views.py
+++ b/recruitment/views/views.py
@@ -43,7 +43,13 @@ from base.backends import ConfiguredEmailBackend
from base.context_processors import check_candidate_self_tracking
from base.countries import country_arr, s_a, states
from base.forms import MailTemplateForm
-from base.methods import export_data, generate_pdf, get_key_instances, sortby
+from base.methods import (
+ eval_validate,
+ export_data,
+ generate_pdf,
+ get_key_instances,
+ sortby,
+)
from base.models import EmailLog, HorillaMailTemplate, JobPosition
from employee.models import Employee, EmployeeWorkInformation
from horilla import settings
@@ -1718,7 +1724,7 @@ def form_send_mail(request, cand_id=None):
candidate_obj = None
stage_id = None
if request.GET.get("stage_id"):
- stage_id = eval(request.GET.get("stage_id"))
+ stage_id = eval_validate(request.GET.get("stage_id"))
if cand_id:
candidate_obj = Candidate.objects.get(id=cand_id)
candidates = Candidate.objects.all()
@@ -2627,7 +2633,7 @@ def create_reject_reason(request):
"""
This method is used to create/update the reject reasons
"""
- instance_id = eval(str(request.GET.get("instance_id")))
+ instance_id = eval_validate(str(request.GET.get("instance_id")))
instance = None
if instance_id:
instance = RejectReason.objects.get(id=instance_id)
@@ -2856,7 +2862,7 @@ def create_skills(request):
"""
This method is used to create the skills
"""
- instance_id = eval(str(request.GET.get("instance_id")))
+ instance_id = eval_validate(str(request.GET.get("instance_id")))
dynamic = request.GET.get("dynamic")
hx_vals = request.GET.get("data")
instance = None
@@ -2920,7 +2926,7 @@ def view_bulk_resumes(request):
"""
This function returns the bulk_resume.html page to the modal
"""
- rec_id = eval(str(request.GET.get("rec_id")))
+ rec_id = eval_validate(str(request.GET.get("rec_id")))
resumes = Resume.objects.filter(recruitment_id=rec_id)
return render(
@@ -2935,7 +2941,7 @@ def add_bulk_resumes(request):
"""
This function is used to create bulk resume
"""
- rec_id = eval(str(request.GET.get("rec_id")))
+ rec_id = eval_validate(str(request.GET.get("rec_id")))
recruitment = Recruitment.objects.get(id=rec_id)
if request.method == "POST":
files = request.FILES.getlist("files")