From 7f0eb9117e73fa9d7b839448149697f8bd60a5ab Mon Sep 17 00:00:00 2001 From: Manuel Raynaud Date: Wed, 30 Apr 2025 16:23:26 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F(drf)=20disable=20browsabl?= =?UTF-8?q?e=20HTML=20API=20renderer=20(#919)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `BrowsableAPIRenderer` generates a form to test POST/PUT/... actions and fill the FK fields with unfiltered data. This issue has been spoted on visio and fixed suitenumerique/meet#508 --- CHANGELOG.md | 1 + src/backend/impress/settings.py | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8103e8bd..5b97afbe 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -28,6 +28,7 @@ and this project adheres to ## Fixed - 🐛(nginx) fix 404 when accessing a doc #866 +- 🔒️(drf) disable browsable HTML API renderer #919 ## [3.1.0] - 2025-04-07 diff --git a/src/backend/impress/settings.py b/src/backend/impress/settings.py index 91623eee..3a0cadb7 100755 --- a/src/backend/impress/settings.py +++ b/src/backend/impress/settings.py @@ -334,6 +334,12 @@ class Base(Configuration): "rest_framework.parsers.JSONParser", "nested_multipart_parser.drf.DrfNestedParser", ], + "DEFAULT_RENDERER_CLASSES": [ + # 🔒️ Disable BrowsableAPIRenderer which provides forms allowing a user to + # see all the data in the database (ie a serializer with a ForeignKey field + # will generate a form with a field with all possible values of the FK). + "rest_framework.renderers.JSONRenderer", + ], "EXCEPTION_HANDLER": "core.api.exception_handler", "DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.PageNumberPagination", "PAGE_SIZE": 20,