Repository: yhdelgado/django-notifications-rest (language: python)

Issue:
security issue for /add
any authenticated user can craft notifications for any other user just by guessing the user_id (in many cases auto incremental).

I suggest to completely remove the endpoint and leave the ability to create notifications only via the internal `notify` method


Discussion / hints:

Fix patch:
diff --git a/README.md b/README.md
index 4512dbe..3117e79 100644
--- a/README.md
+++ b/README.md
@@ -54,4 +54,10 @@ If the installed version of django>=3.1, then::
         ...
     ]
  
-To run schema migration, execute ``python manage.py migrate``.
\ No newline at end of file
+To run schema migration, execute ``python manage.py migrate``.
+
+-------------------
+Additional options:
+-------------------
+
+There is also ``/add/`` API endpoint to add new notifications. Such endpoint might be considered security risk, as any user can add any notifications. For that reason, it must be manually enabled by setting ``NOTIFICATIONS_API_ALLOW_ADD=True``
diff --git a/notifications_rest/urls.py b/notifications_rest/urls.py
index 801a9a6..30355da 100644
--- a/notifications_rest/urls.py
+++ b/notifications_rest/urls.py
@@ -1,4 +1,5 @@
 from django.urls import re_path as url
+from django.conf import settings
 from .views import *
 from rest_framework import routers
 
@@ -7,7 +8,6 @@
 
 app_name = 'notifications_rest'
 urlpatterns = [
-    url(r'^add/', AddNotification.as_view(), name='add'),
     url(r'^all/', AllNotification.as_view({'get': 'list'}), name='all'),
     url(r'^unread/', UnreadNotificationsList.as_view({'get': 'list'}), name='unread'),
     url(r'^mark-all-as-read/$', MarkAllAsRead.as_view(), name='mark_all_as_read'),
@@ -17,3 +17,8 @@
     url(r'^unread_count/$', UnreadNotificationCount.as_view(), name='unread_notification_count'),
     url(r'^all_count/$', AllNotificationCount.as_view(), name='all_notification_count'),
 ]
+
+if getattr(settings, 'NOTIFICATIONS_API_ALLOW_ADD', False):
+    urlpatterns += [
+        url(r'^add/', AddNotification.as_view(), name='add'),
+    ]


Test patch:
diff --git a/notifications_rest/tests/test_views.py b/notifications_rest/tests/test_views.py
index d0f5a4b..6adefc3 100644
--- a/notifications_rest/tests/test_views.py
+++ b/notifications_rest/tests/test_views.py
@@ -1,5 +1,6 @@
 from django.contrib.auth import get_user_model
 from django.urls import reverse
+from django.urls.exceptions import NoReverseMatch
 from notifications.models import Notification
 from rest_framework import status
 from rest_framework.test import APIClient, APITestCase
diff --git a/test_project/settings.py b/test_project/settings.py
index 3389ba7..89538b3 100644
--- a/test_project/settings.py
+++ b/test_project/settings.py
@@ -107,3 +107,5 @@
         "rest_framework.authentication.BasicAuthentication",
     ],
 }
+
+NOTIFICATIONS_API_ALLOW_ADD = True