Skip to content

Minor code hardening and template cleanups#1633

Closed
davmlaw wants to merge 1 commit into
masterfrom
code-hardening/escaping-and-key-generation
Closed

Minor code hardening and template cleanups#1633
davmlaw wants to merge 1 commit into
masterfrom
code-hardening/escaping-and-key-generation

Conversation

@davmlaw

@davmlaw davmlaw commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

🤖 Written by Claude

A handful of small, self-contained code-quality improvements.

  • SECRET_KEY generation — generate the Django SECRET_KEY with the standard django.core.management.utils.get_random_secret_key() instead of the bespoke random-based generate_key() helper. Only affects fresh deployments where django_secret_key.txt does not yet exist; existing keys are untouched.
  • IconWithTooltip — build the <i> markup with format_html() instead of hand-assembling a SafeString, removing the manual escaping and dropping now-unused imports.
  • variant_details.html — use the escapejs filter (instead of |safe) for the two values embedded in inline <script> string literals, so they are always correctly encoded for a JS-string context.
  • MONDO search — cap the length of the free-text search_term forwarded to the external Monarch search API.
  • OIDC group sync — when removing a group a user has left, look it up with .filter(...).first() so a group deleted out-of-band between logins no longer raises during login.

No behaviour change for normal inputs; py_compile clean.

- Generate Django SECRET_KEY with django.core.management.utils.get_random_secret_key()
  instead of the home-grown random-based generator
- Build IconWithTooltip markup with format_html() rather than hand-assembling a SafeString
- Use the escapejs filter (not |safe) for values embedded in inline JS string literals
  in variant_details.html
- Cap the length of the free-text MONDO search term forwarded to the external Monarch API
- Guard OIDC group removal so a group deleted out-of-band doesn't raise during login
@davmlaw

davmlaw commented Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

🤖 Written by Claude

Superseded by per-app PRs (one PR per change). Closing this combined PR.

@davmlaw davmlaw closed this Jun 25, 2026
@davmlaw davmlaw deleted the code-hardening/escaping-and-key-generation branch June 25, 2026 04:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant