Update Telegram instructions. Fix redirect after login when adding Telegram integration.

CHANGELOG.md

@@ -15,6 +15,7 @@ All notable changes to this project will be documented in this file.
 - API security: check channel ownership when setting check's channels
 - API: update check's "alert_after" field when changing schedule
 - API: validate channel identifiers before creating/updating a check (#335)
+- Fix redirect after login when adding Telegram integration
 
 ## v1.13.0 - 2020-02-13
 

hc/accounts/views.py

@@ -1,4 +1,5 @@
 from datetime import timedelta as td
+from urllib.parse import urlparse
 import uuid
 
 from django.conf import settings
@@ -42,12 +43,17 @@ NEXT_WHITELIST = (
     "hc-p-channels",
     "hc-add-slack",
     "hc-add-pushover",
+    "hc-add-telegram",
 )
 
 
-def _is_whitelisted(path):
+def _is_whitelisted(redirect_url):
+    if not redirect_url:
+        return False
+
+    parsed = urlparse(redirect_url)
     try:
-        match = resolve(path)
+        match = resolve(parsed.path)
     except Resolver404:
         return False
 

hc/front/tests/test_add_telegram.py

@@ -34,6 +34,13 @@ class AddTelegramTestCase(BaseTestCase):
         self.assertEqual(c.telegram_name, "My Group")
         self.assertEqual(c.project, self.project)
 
+    def test_it_handles_bad_signature(self):
+        self.client.login(username="alice@example.org", password="password")
+        r = self.client.get(self.url + "?bad-signature")
+        self.assertContains(r, "Incorrect Link")
+
+        self.assertFalse(Channel.objects.exists())
+
     @patch("hc.api.transports.requests.request")
     def test_it_sends_invite(self, mock_get):
         data = {

hc/front/urls.py

@@ -30,6 +30,7 @@ channel_urls = [
     ),
     path("add_discord/", views.add_discord_complete, name="hc-add-discord-complete"),
     path("add_pushover/", views.add_pushover_help),
+    path("telegram/", views.add_telegram_help),
     path("telegram/bot/", views.telegram_bot, name="hc-telegram-webhook"),
     path("add_pdc/", views.add_pdc_help),
     path("add_slack/", views.add_slack_help),

hc/front/views.py

@@ -1398,12 +1398,24 @@ def telegram_bot(request):
     return HttpResponse()
 
 
+def add_telegram_help(request):
+    ctx = {
+        "page": "channels",
+        "bot_name": settings.TELEGRAM_BOT_NAME,
+    }
+
+    return render(request, "integrations/add_telegram.html", ctx)
+
+
 @login_required
 def add_telegram(request):
     chat_id, chat_type, chat_name = None, None, None
     qs = request.META["QUERY_STRING"]
     if qs:
+        try:
             chat_id, chat_type, chat_name = signing.loads(qs, max_age=600)
+        except signing.BadSignature:
+            return render(request, "bad_link.html")
 
     if request.method == "POST":
         project = _get_project_for_user(request, request.POST.get("project"))

templates/integrations/add_slack_btn.html

@@ -1,7 +1,7 @@
 {% extends "base.html" %}
 {% load humanize static hc_extras %}
 
-{% block title %}Add Slack - {% site_name %}{% endblock %}
+{% block title %}Slack Integration for {% site_name %}{% endblock %}
 
 {% block content %}
 <div class="row">

templates/integrations/add_telegram.html

@@ -1,7 +1,7 @@
 {% extends "base.html" %}
 {% load compress humanize static hc_extras %}
 
-{% block title %}Notification Channels - {% site_name %}{% endblock %}
+{% block title %}Telegram Integration for {% site_name %}{% endblock %}
 
 
 {% block content %}
@@ -24,7 +24,6 @@
     </div>
 
     <h2>Integration Settings</h2>
-
     <form id="add-telegram" method="post" class="form-horizontal">
         {% csrf_token %}
         <div class="form-group">
@@ -98,7 +97,9 @@
             <p>Click or tap on the confirmation link, and
             {% site_name %} will open in a browser window asking you to
              confirm the new integration.</p>
-            <p>Confirm the integration, and it's done!</p>
+            <p>Select the project you want the Telegram integration added to,
+            click on "Connect Telegram", and it's done!</p>
+
         </div>
         <div class="col-sm-6">
             <img