LGA-3535 - Add traversal protection

app/categories/constants.py

@@ -12,6 +12,7 @@ class Category:
     chs_code: Optional[str] = None
     # Internal code
     code: Optional[str] = None
+    in_scope: Optional[bool] = False
     children: dict[str, "Category"] | None = field(default_factory=dict)
     parent_code: Optional[str] = None
     _referrer_text: Optional[LazyString] = None
@@ -84,20 +85,23 @@ def __str__(self):
                 "Includes keeping you or your family safe, getting court orders and help if someone is ignoring a court order. Also, if you’re being stalked, threatened or harassed."
             ),
             code="protect_you_and_your_children",
+            in_scope=True,
         ),
         "leaving_an_abusive_relationship": Category(
             title=_("Leaving an abusive relationship"),
             description=_(
                 "Help with divorce, separation, or leaving your partner. Includes legal arrangements for children, money and housing."
             ),
             code="leaving_an_abusive_relationship",
+            in_scope=True,
         ),
         "problems_with_ex_partner": Category(
             title=_("Problems with an ex-partner: children or money"),
             description=_(
                 "Includes arrangements for children and money. If an ex-partner is not following agreements or court orders. If you’re worried about a child, or if a child is taken or kept without your permission."
             ),
             code="problems_with_ex_partner",
+            in_scope=True,
         ),
         "problems_with_neighbours": Category(
             title=_("Problems with neighbours, landlords or other people"),
@@ -119,11 +123,13 @@ def __str__(self):
                 "Help with forced marriage and Forced Marriage Protection Orders."
             ),
             code="forced_marriage",
+            in_scope=True,
         ),
         "fgm": Category(
             title=_("Female genital mutilation (FGM)"),
             description=_("If you or someone else is at risk of FGM."),
             code="fgm",
+            in_scope=True,
         ),
     },
 )
@@ -164,6 +170,7 @@ def __str__(self):
                 "Help to cover the costs of family mediation (solve problems about money and children before you go to court)."
             ),
             code="family_mediation",
+            in_scope=True,
         ),
         "child_abducted": Category(
             title=_("Child taken without your consent"),
@@ -183,6 +190,7 @@ def __str__(self):
                 "Advice about legal action against a school. Includes if a child is out of school, exclusions, transport to school, judicial reviews."
             ),
             code="education",
+            in_scope=True,
         ),
         "forced_marriage": Category(
             title=_("Forced marriage"),
@@ -209,44 +217,51 @@ def __str__(self):
                 "Help if you’re homeless, or might be homeless in the next 2 months. This could be because of rent arrears, debt, the end of a relationship, or because you have nowhere to live."
             ),
             code="homelessness",
+            in_scope=True,
         ),
         "eviction": Category(
             title=_("Eviction, told to leave your home"),
             description=_(
                 "Landlord has told you to leave or is trying to force you to leave. Includes if you’ve got a Section 21 or a possession order."
             ),
             code="eviction",
+            in_scope=True,
         ),
         "forced_to_sell": Category(
             title=_("Forced to sell or losing the home you own"),
             description=_(
                 "Repossession by your mortgage company; bankruptcy or other debt that means you will lose the home you own."
             ),
             code="forced_to_sell",
+            in_scope=True,
         ),
         "repairs": Category(
             title=_("Repairs, health and safety"),
             description=_(
                 "If your house is not safe to live in, or needs repairs, and this is causing health or safety problems."
             ),
             code="repairs",
+            in_scope=True,
         ),
         "council_housing": Category(
             title=_("Problems with council housing"),
             description=_(
                 "Help to challenge the council’s decision about giving you housing. It includes if the council has offered a house that is not right for you, or that needs repairs or adaptations."
             ),
             code="council_housing",
+            in_scope=True,
         ),
         "threatened": Category(
             title=_("Being threatened or harassed where you live"),
             description=_("By a landlord, neighbour or someone else."),
             code="threatened",
+            in_scope=True,
         ),
         "asylum_seeker": Category(
             title=_("If you’re an asylum-seeker"),
             description=_("Applying for housing, losing your housing or homelessness."),
             code="asylum_seeker",
+            in_scope=True,
         ),
         "discrimination": Category(
             title=_("Discrimination"),
@@ -261,6 +276,7 @@ def __str__(self):
                 "Accused of anti-social behaviour by the landlord, council or housing association."
             ),
             code="antisocial_behaviour",
+            in_scope=True,
         ),
     },
 )
@@ -273,6 +289,7 @@ def __str__(self):
     article_category_name="Discrimination",
     chs_code="discrimination",
     code="discrimination",
+    in_scope=True,
 )
 
 EDUCATION = Category(
@@ -295,20 +312,23 @@ def __str__(self):
                 "Applying for or going to a SEND tribunal, appealing a decision by a tribunal."
             ),
             code="tribunals",
+            in_scope=True,
         ),
         "discrimination": Category(
             title=_("Child treated unfairly at school, discrimination"),
             description=_(
                 "If a child is treated unfairly at school because of their disability. Or if you were treated badly for complaining about this."
             ),
             code="discrimination",
+            in_scope=True,
         ),
         "schools": Category(
             title=_("Other problems with schools"),
             description=_(
                 "Advice about legal action against a school. Includes if a child is out of school, exclusions, transport to school, judicial reviews."
             ),
             code="schools",
+            in_scope=True,
         ),
         "care": Category(
             title=_("Care needs for disability (social care)"),
@@ -422,6 +442,7 @@ def __str__(self):
                 "Help to apply for housing, problems with housing or if you are homeless."
             ),
             code="housing",
+            in_scope=True,
         ),
         "domestic_abuse": Category(
             title=_("Stay in the UK if you experienced domestic abuse"),

app/categories/discrimination/forms.py

@@ -53,6 +53,7 @@ class DiscriminationWhereForm(DiscriminationQuestionForm):
 
 
 class DiscriminationWhyForm(DiscriminationQuestionForm):
+    depends_on = DiscriminationWhereForm
     title = _("Why were you discriminated against?")
 
     next_step_mapping = {
@@ -102,6 +103,7 @@ class DiscriminationWhyForm(DiscriminationQuestionForm):
 
 
 class DiscriminationAreYouUnder18Form(AreYouUnder18Form):
+    depends_on = DiscriminationWhyForm
     category = DISCRIMINATION
 
     next_step_mapping = {

app/categories/mixins.py

@@ -0,0 +1,15 @@
+from flask import session, redirect, url_for
+
+
+class InScopeMixin:
+    def dispatch_request(self):
+        response = self.ensure_in_scope()
+        if not response:
+            response = super().dispatch_request()
+
+        return response
+
+    def ensure_in_scope(self):
+        if not session.in_scope:
+            return redirect(url_for("main.session_expired"))
+        return None

app/categories/results/urls.py

@@ -5,10 +5,18 @@
     CannotFindYourProblemPage,
     NextStepsPage,
 )
+from app.categories.mixins import InScopeMixin
+
+
+class InScopeResultPage(InScopeMixin, ResultPage):
+    pass
+
 
 bp.add_url_rule(
     "/legal-aid-available",
-    view_func=ResultPage.as_view("in_scope", template="categories/in-scope.html"),
+    view_func=InScopeResultPage.as_view(
+        "in_scope", template="categories/in-scope.html"
+    ),
 )
 bp.add_url_rule(
     "/legal-aid-available-hlpas",

app/categories/send/forms.py

@@ -3,4 +3,4 @@
 
 
 class SendChildInCareQuestionForm(ChildInCareQuestionForm):
-    category = EDUCATION
+    category = EDUCATION.sub.tribunals

app/categories/views.py

@@ -1,6 +1,7 @@
 from flask.sansio.blueprints import Blueprint
 from flask.views import View
 from flask import render_template, redirect, url_for, session, request
+from flask_babel import LazyString
 from app.categories.forms import QuestionForm
 from app.categories.constants import Category
 from app.categories.models import CategoryAnswer, QuestionType
@@ -214,6 +215,19 @@ def update_session(self, form: QuestionForm) -> None:
         )
         super().update_session(category_answer)
 
+    def ensure_form_dependency(self, form):
+        """Ensure dependant forms have been completed"""
+        depends_on = getattr(form, "depends_on", None)
+        if depends_on and issubclass(depends_on, QuestionForm):
+            title = depends_on.title
+            if isinstance(title, LazyString):
+                title = title._args[0]
+            answer = session.get_category_question_answer(title)
+            if answer is None:
+                return redirect(url_for("main.session_expired"))
+
+        return None
+
     def process_request(self):
         """Handle requests for the question page, including form submissions.
 
@@ -225,6 +239,11 @@ def process_request(self):
             Either a redirect to the next page or the rendered template
         """
         form = self.form_class(request.args)
+        # Make sure previous forms have been completed
+        form_protection_redirect = self.ensure_form_dependency(form)
+        if form_protection_redirect:
+            return form_protection_redirect
+
         session.category = form.category
 
         if form.submit.data and form.validate():

app/contact/urls.py

@@ -1,13 +1,35 @@
 from app.contact import bp
 from app.contact.address_finder.widgets import FormattedAddressLookup
 from app.contact.views import ContactUs, ReasonForContacting
-from flask import jsonify
+from app.means_test.api import EligibilityState, is_eligible
+from flask import jsonify, session, redirect, url_for
 import logging
 from app.contact.views import ConfirmationPage
 
+
 logger = logging.getLogger(__name__)
 
 
+class EligibleContactUsPage(ContactUs):
+    def dispatch_request(self):
+        if not session.ec_reference:
+            return redirect(url_for("main.session_expired"))
+
+        state = is_eligible(session.ec_reference)
+        if state != EligibilityState.YES:
+            return redirect(url_for("main.session_expired"))
+
+        return super().dispatch_request()
+
+
+bp.add_url_rule(
+    "/eligible",
+    view_func=EligibleContactUsPage.as_view(
+        "eligible", template="contact/eligible.html", attach_eligiblity_data=True
+    ),
+)
+
+
 bp.add_url_rule(
     "/reasons-for-contacting",
     view_func=ReasonForContacting.as_view("reasons_for_contacting"),
@@ -29,11 +51,4 @@ def geocode(postcode):
     view_func=ContactUs.as_view("contact_us", attach_eligiblity_data=False),
 )
 
-bp.add_url_rule(
-    "/eligible",
-    view_func=ContactUs.as_view(
-        "eligible", template="contact/eligible.html", attach_eligiblity_data=True
-    ),
-)
-
 bp.add_url_rule("/confirmation", view_func=ConfirmationPage.as_view("confirmation"))

app/means_test/api.py

@@ -1,3 +1,4 @@
+from enum import Enum
 from app.api import cla_backend
 from flask import session
 from app.means_test.forms.income import IncomeForm
@@ -7,10 +8,16 @@
 from app.means_test.money_interval import MoneyInterval
 
 
+class EligibilityState(str, Enum):
+    YES: str = "yes"
+    NO: str = "no"
+    UNKNOWN: str = "unknown"
+
+
 def update_means_test(payload):
     means_test_endpoint = "checker/api/v1/eligibility_check/"
 
-    ec_reference = session.get("ec_reference")
+    ec_reference = session.ec_reference
 
     if ec_reference:
         response = cla_backend.patch(
@@ -19,14 +26,15 @@ def update_means_test(payload):
         return response
     else:
         response = cla_backend.post(means_test_endpoint, json=payload)
-        session["ec_reference"] = response["reference"]
+        session.ec_reference = response["reference"]
         return response
 
 
-def is_eligible(reference):
+def is_eligible(reference) -> EligibilityState:
     means_test_endpoint = "checker/api/v1/eligibility_check/"
-    response = cla_backend.post(f"{means_test_endpoint}{reference}/is_eligible/")
-    return response["is_eligible"]
+    response = cla_backend.post(f"{means_test_endpoint}{reference}/is_eligible/", {})
+    state = response["is_eligible"]
+    return getattr(EligibilityState, state.upper(), EligibilityState.UNKNOWN)
 
 
 def get_means_test_payload(eligibility_data) -> dict: