Replace details_url with cloaked_url in email and chat notifications

CHANGELOG.md

@@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file.
 - Add a "Subject" field in the "Ping Details" dialog
 - Improve HTML email display in the "Ping Details" dialog
 - Add a link to check's details page in Slack notifications
+- Replace details_url with cloaked_url in email and chat notifications
 
 ## Bug Fixes
 - Fix downtime summary to handle months when the check didn't exist yet (#472)

hc/api/tests/test_notify_email.py

@@ -60,6 +60,12 @@ class NotifyEmailTestCase(BaseTestCase):
         self.assertIn("112233", html)
         self.assertIn("Body Line 1<br>Body Line 2", html)
 
+        # Check's code must not be in the html
+        self.assertNotIn(str(self.check.code), html)
+
+        # Check's code must not be in the plain text body
+        self.assertNotIn(str(self.check.code), email.body)
+
     def test_it_shows_cron_schedule(self):
         self.check.kind = "cron"
         self.check.schedule = "0 18-23,0-8 * * *"

hc/api/tests/test_notify_msteams.py

@@ -1,5 +1,7 @@
 # coding: utf-8
 
+import json
+
 from datetime import timedelta as td
 from unittest.mock import patch
 
@@ -42,6 +44,10 @@ class NotifyTestCase(BaseTestCase):
         self.assertEqual(payload["summary"], "“_underscores_ & more” is DOWN.")
         self.assertEqual(payload["title"], "“_underscores_ & more” is DOWN.")
 
+        # The payload should not contain check's code
+        serialized = json.dumps(payload)
+        self.assertNotIn(str(self.check.code), serialized)
+
     @patch("hc.api.transports.requests.request")
     def test_msteams_escapes_html_and_markdown_in_desc(self, mock_post):
         self._setup_data("http://example.com/webhook")

hc/api/tests/test_notify_slack.py

@@ -11,9 +11,10 @@ from requests.exceptions import Timeout
 from django.test.utils import override_settings
 
 
-class NotifyTestCase(BaseTestCase):
+class NotifySlackTestCase(BaseTestCase):
     def _setup_data(self, value, status="down", email_verified=True):
         self.check = Check(project=self.project)
+        self.check.name = "Foobar"
         self.check.status = status
         self.check.last_ping = now() - td(minutes=61)
         self.check.save()
@@ -39,8 +40,9 @@ class NotifyTestCase(BaseTestCase):
         fields = {f["title"]: f["value"] for f in attachment["fields"]}
         self.assertEqual(fields["Last Ping"], "an hour ago")
 
-        uncloak_url = "/cloaked/%s/" % self.check.unique_key
+        # The payload should not contain check's code
-        self.assertTrue(attachment["title_link"].endswith(uncloak_url))
+        serialized = json.dumps(payload)
+        self.assertNotIn(str(self.check.code), serialized)
 
     @patch("hc.api.transports.requests.request")
     def test_slack_with_complex_value(self, mock_post):

hc/api/tests/test_notify_zulip.py

@@ -13,6 +13,7 @@ from hc.test import BaseTestCase
 class NotifyTestCase(BaseTestCase):
     def _setup_data(self, value, status="down", email_verified=True):
         self.check = Check(project=self.project)
+        self.check.name = "Foobar"
         self.check.status = status
         self.check.last_ping = now() - td(minutes=61)
         self.check.save()
@@ -46,6 +47,10 @@ class NotifyTestCase(BaseTestCase):
         payload = kwargs["data"]
         self.assertIn("DOWN", payload["topic"])
 
+        # payload should not contain check's code
+        serialized = json.dumps(payload)
+        self.assertNotIn(str(self.check.code), serialized)
+
     @patch("hc.api.transports.requests.request")
     def test_zulip_returns_error(self, mock_post):
         definition = {

hc/api/tests/test_sendreports.py

@@ -93,6 +93,11 @@ class SendReportsTestCase(BaseTestCase):
         self.assertTrue(self.profile.next_nag_date > now())
         self.assertEqual(len(mail.outbox), 1)
 
+        email = mail.outbox[0]
+        html = email.alternatives[0][0]
+        self.assertNotIn(str(self.check.code), email.body)
+        self.assertNotIn(str(self.check.code), html)
+
     def test_it_obeys_next_nag_date(self):
         self.profile.next_nag_date = now() + td(days=1)
         self.profile.save()

templates/emails/alert-body-html.html

@@ -3,7 +3,7 @@
 
 <p>
     "{{ check.name_then_code }}" is {{ check.status|upper }}.
-    <a href="{{ check.details_url }}">View on {% site_name %}&hellip;</a>
+    <a href="{{ check.cloaked_url }}">View on {% site_name %}&hellip;</a>
 </p>
 
 

templates/emails/alert-body-text.html

@@ -5,7 +5,7 @@ Additional notes:
 {{ check.desc }}
 {% endif %}
 More information:
-{{ check.details_url }}
+{{ check.cloaked_url }}
 
 --
 Regards,

templates/emails/summary-html.html

@@ -63,7 +63,7 @@
                 Never
             {% endif %}
             <br />
-            <a href="{{ check.details_url }}" target="_blank">Details…</a>
+            <a href="{{ check.cloaked_url }}" target="_blank">Details…</a>
         </td>
     </tr>
     {% endfor %}

templates/integrations/msteams_message.json

@@ -45,7 +45,7 @@
             "targets": [
                 {
                     "os": "default",
-                    "uri": "{{ check.details_url }}"
+                    "uri": "{{ check.cloaked_url }}"
                 }
             ]
         }

templates/integrations/trello_desc.html

@@ -11,4 +11,4 @@
 
 **Last Ping:** {{ check.last_ping|naturaltime }}
 
-[Full Details @ {% site_name %}]({{ check.details_url }})
+[Full Details @ {% site_name %}]({{ check.cloaked_url }})

templates/integrations/zulip_content.html

@@ -1,6 +1,6 @@
 {% load hc_extras humanize %}
 
-[{{ check.name_then_code }}]({{ check.details_url }}) is **{{ check.status|upper }}**. {% if check.status == "down" %}Last ping was {{ check.last_ping|naturaltime }}.{% endif %}
+[{{ check.name_then_code }}]({{ check.cloaked_url }}) is **{{ check.status|upper }}**. {% if check.status == "down" %}Last ping was {{ check.last_ping|naturaltime }}.{% endif %}
 
 {% if check.desc %}
 ---