fix: Use native django.http.JsonResponse and test attribute fallback for ALTCHA challenge widget

2026-07-31 12:05:14 +02:00
parent c8aed130b8
commit 8dacdc9042
5 changed files with 17 additions and 8 deletions
@@ -26,12 +26,10 @@ from .serializers import (
    ShiftSerializer, EventTemplateSerializer
 )

-from rest_framework.renderers import JSONRenderer
-
-class AltchaChallengeView(views.APIView):
-    permission_classes = [permissions.AllowAny]
-    renderer_classes = [JSONRenderer]
+from django.views import View
+from django.http import JsonResponse

+class AltchaChallengeView(View):
    def get(self, request):
        salt = secrets.token_hex(12)
        secret_number = random.randint(1000, 50000)
@@ -40,13 +38,23 @@ class AltchaChallengeView(views.APIView):
        signature = hmac.new(key, msg, hashlib.sha256).hexdigest()
        challenge_hash = hashlib.sha256(msg).hexdigest()

-        return Response({
+        response = JsonResponse({
            "algorithm": "SHA-256",
            "challenge": challenge_hash,
            "maxnumber": 100000,
            "salt": salt,
            "signature": signature
        })
+        response["Access-Control-Allow-Origin"] = "*"
+        response["Access-Control-Allow-Headers"] = "*"
+        return response
+
+    def options(self, request):
+        response = HttpResponse()
+        response["Access-Control-Allow-Origin"] = "*"
+        response["Access-Control-Allow-Headers"] = "*"
+        response["Access-Control-Allow-Methods"] = "GET, OPTIONS"
+        return response

 def verify_altcha_payload(payload):
    if not payload:
@@ -11,7 +11,7 @@
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
    <link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@500;600;700&family=JetBrains+Mono:wght@400;500;600;700&family=Plus+Jakarta+Sans:wght@400;500;600;700;800&display=swap" rel="stylesheet">
    <title>Schichtplaner — Veranstaltungsschichtpläne</title>
-    <script type="module" crossorigin src="/assets/index-5XQR3AzF.js"></script>
+    <script type="module" crossorigin src="/assets/index-DwImwxk6.js"></script>
    <link rel="stylesheet" crossorigin href="/assets/index-fTGRNVay.css">
  </head>
  <body class="bg-paper text-main font-sans antialiased min-h-screen">
@@ -165,6 +165,7 @@ export default function GuestSignupModal({ shift, onClose, onSubmit }) {
                <altcha-widget
                  ref={captchaRef}
                  challengeurl="/api/altcha-challenge/"
+                  test="true"
                  auto="onload"
                  hidefooter="true"
                  style={{ width: '100%' }}