Upgrade to Django 4.1.x (#3398)

- Upgrade Django, wagtail-purge,
Django-pwned-password,django-basic-auth-ip-whitelist
- Move logic from DeleteView -> delete() to form_valid()
- Make test more robust
- Upgrade dj-database-url to 2.x, and enable CONN_HEALTH_CHECKS
- Bump django-two-factor-auth to 1.15.x that has confirmed support for
Django 4.1
- Bump django-ratelimit to 4.1.0
- django-pwned-passwords seems be abandoned
jamiecounsell/django-pwned-passwords#11
(replaced with it with it's fork)

hypha/apply/funds/views.py

@@ -1021,17 +1021,16 @@ def get_success_url(self):
         )
         return reverse_lazy("funds:submissions:detail", args=(submission.id,))
 
-    def delete(self, request, *args, **kwargs):
+    def form_valid(self, form):
         reminder = self.get_object()
         messenger(
             MESSAGES.DELETE_REMINDER,
-            user=request.user,
-            request=request,
+            user=self.request.user,
+            request=self.request,
             source=reminder.submission,
             related=reminder,
         )
-        response = super().delete(request, *args, **kwargs)
-        return response
+        return super().form_valid(form)
 
 
 class AdminSubmissionDetailView(ActivityContextMixin, DelegateableView, DetailView):
@@ -1554,21 +1553,22 @@ class SubmissionDeleteView(DeleteView):
     model = ApplicationSubmission
     success_url = reverse_lazy("funds:submissions:list")
 
-    def delete(self, request, *args, **kwargs):
+    def form_valid(self, form):
         submission = self.get_object()
         messenger(
             MESSAGES.DELETE_SUBMISSION,
-            user=request.user,
-            request=request,
+            user=self.request.user,
+            request=self.request,
             source=submission,
         )
-        # delete NEW_SUBMISSION event for this particular submission
+
+        # Delete NEW_SUBMISSION event for this particular submission
         Event.objects.filter(
             type=MESSAGES.NEW_SUBMISSION, object_id=submission.id
         ).delete()
-        # delete submission
-        response = super().delete(request, *args, **kwargs)
-        return response
+
+        # delete submission and redirect to success url
+        return super().form_valid(form)
 
 
 @method_decorator(login_required, name="dispatch")

hypha/apply/projects/views/payment.py

@@ -118,8 +118,8 @@ def dispatch(self, request, *args, **kwargs):
         return super().dispatch(request, *args, **kwargs)
 
     @transaction.atomic()
-    def delete(self, request, *args, **kwargs):
-        response = super().delete(request, *args, **kwargs)
+    def form_valid(self, form):
+        response = super().form_valid(form)
 
         messenger(
             MESSAGES.DELETE_INVOICE,

hypha/apply/review/views.py

@@ -475,17 +475,16 @@ def test_func(self):
             or self.request.user == review.author.reviewer
         )
 
-    def delete(self, request, *args, **kwargs):
+    def form_valid(self, form):
         review = self.get_object()
         messenger(
             MESSAGES.DELETE_REVIEW,
-            user=request.user,
-            request=request,
+            user=self.request.user,
+            request=self.request,
             source=review.submission,
             related=review,
         )
-        response = super().delete(request, *args, **kwargs)
-        return response
+        return super().form_valid(form)
 
     def get_success_url(self):
         review = self.get_object()

hypha/apply/users/views.py

@@ -8,10 +8,7 @@
 from django.contrib.auth.decorators import login_required, permission_required
 from django.contrib.auth.forms import AdminPasswordChangeForm
 from django.contrib.auth.tokens import PasswordResetTokenGenerator
-from django.contrib.auth.views import (
-    INTERNAL_RESET_SESSION_TOKEN,
-    SuccessURLAllowedHostsMixin,
-)
+from django.contrib.auth.views import INTERNAL_RESET_SESSION_TOKEN
 from django.contrib.auth.views import (
     PasswordResetConfirmView as DjPasswordResetConfirmView,
 )
@@ -67,7 +64,7 @@
     ratelimit(key="ip", rate=settings.DEFAULT_RATE_LIMIT, method="POST"),
     name="dispatch",
 )
-class RegisterView(SuccessURLAllowedHostsMixin, View):
+class RegisterView(View):
     redirect_field_name = "next"
     form = CustomUserCreationForm
 
@@ -343,7 +340,7 @@ def get_user(self, uidb64):
             return None
 
 
-class ActivationView(SuccessURLAllowedHostsMixin, TemplateView):
+class ActivationView(TemplateView):
     redirect_field_name = "next"
 
     def get(self, request, *args, **kwargs):

hypha/settings/base.py

@@ -157,10 +157,14 @@
 APP_NAME = env.str("APP_NAME", "hypha")
 DATABASES = {
     "default": dj_database_url.config(
-        conn_max_age=600, default=f"postgres:///{APP_NAME}"
+        default=f"postgres:///{APP_NAME}", conn_max_age=600, conn_health_checks=True
     )
 }
 
+# https://docs.djangoproject.com/en/4.1/ref/settings/#conn-health-checks
+# Setting this to True, as we are using a non-zero valve for conn_max_age in dj_database_url.config
+CONN_HEALTH_CHECKS = env.bool("CONN_HEALTH_CHECKS", True)
+
 # Language code in standard language id format: en, en-gb, en-us
 # The corrosponding locale dir is named: en, en_GB, en_US
 LANGUAGE_CODE = env.str("LANGUAGE_CODE", "en")

requirements.txt

@@ -7,10 +7,10 @@ Babel==2.11.0
 bleach==5.0.0
 boto3==1.28.68
 celery==5.2.7
-dj-database-url==0.5.0
 click==8.1.7
+dj-database-url==2.1.0
 django-anymail==9.0
-django-basic-auth-ip-whitelist==0.3.4
+django-basic-auth-ip-whitelist==0.5
 django-bleach==3.0.1
 django-countries==7.5.1
 django-elevate==2.0.3
@@ -23,17 +23,18 @@ django-heroku==0.3.1
 django-hijack==3.2.6
 django-htmx==1.17.0
 django-pagedown==2.2.1
-django-pwned-passwords==4.1.0
-django-ratelimit==4.0.0
+# django-pwned-passwords==4.1.0
+https://github.com/slinkymanbyday/django-pwned-passwords/archive/58c7b832df7360a21fd8edeaaf9f897c7517baf1.zip
+django-ratelimit==4.1.0
 django-referrer-policy==1.0
 django-select2==8.0.0
 django-slack==5.18.0
 django-storages==1.13.2
 django-tables2==2.5.1
 django-tinymce==3.5.0
-django-two-factor-auth==1.14.0
+django-two-factor-auth==1.15.5
 django-web-components==0.1.1
-django==3.2.23
+django==4.1.13
 djangorestframework-api-key==2.3.0
 djangorestframework==3.14.0
 drf-nested-routers==0.93.4
@@ -56,7 +57,7 @@ social_auth_app_django==5.0.0
 tablib==3.5.0
 tomd==0.1.3
 wagtail-cache==2.2.0
-wagtail-purge==0.2
+wagtail-purge==0.3.0
 wagtail==4.2.2
 whitenoise==5.3.0
 xhtml2pdf==0.2.11