From a69384fdd3396946b755b21cc2b4bd24baa32003 Mon Sep 17 00:00:00 2001
From: Sander Roosendaal <sanderroosendaal@proton.me>
Date: Mon, 2 Dec 2024 22:03:53 +0100
Subject: [PATCH] security fixes

---
 rowers/plannedsessions.py             |   4 ++++
 rowers/tests/testdata/testdata.tcx.gz | Bin 3998 -> 3998 bytes
 rowers/views/apiviews.py              |   5 ++++-
 rowers/weather.py                     |   3 ++-
 4 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/rowers/plannedsessions.py b/rowers/plannedsessions.py
index c8ca0ab2..d9e6add5 100644
--- a/rowers/plannedsessions.py
+++ b/rowers/plannedsessions.py
@@ -888,6 +888,10 @@ def get_dates_timeperiod(request, startdatestring='', enddatestring='',
                 startdate = timezone.now()-timezone.timedelta(days=5)
                 startdate = startdate.date()
                 enddate = timezone.now().date()
+            except parser.ParserError:
+                startdate = timezone.now()-timezone.timedelta(days=5)
+                startdate = startdate.date()
+                enddate = timezone.now().date()
 
         if startdate > enddate:
             e = startdate
diff --git a/rowers/tests/testdata/testdata.tcx.gz b/rowers/tests/testdata/testdata.tcx.gz
index 81d458fd4adb5110095b9dff6dca80052114e59c..a12f9e93dea8c9787d530429a5d32f8dea26f3f4 100644
GIT binary patch
delta 256
zcmV+b0ssD<AD$lvABzYGP9RRP2dNH!U0?vRV&S{v{)dCb?tnYHGkyGx`Sazc)$aR)
zhZl+C*~N!_pLOZ&xj1{f>DDj1lauY!N*`D2<Ck6ErSo>Xw<}Tkblky%*Zr%riz~0m
zgY)x~)lt`{pMLpbT%P-@lcn!|dc8V%dHHjHOYdVk^vc8eu;pp@pLEIWEV%k_`Rm<Q
z>$KU+r~S4YE+6d|=RbInZu;=o<;k+!EE9+P>BFPDa$g5ey7lqnM~6Q@%WSrP?zaDu
z-r{GkPybk^I|H}}u>1dDapjBMlixn3!#i8lt95z~4-?Ae#iR5z{z#WTyz@W&J7;3V
GfB^v8AeYhr

delta 256
zcmV+b0ssD<AD$lvABzYGmn=rH2dNH!!Fm!3jPTuY|HHvzcfg(9nLhr;{Q2_JYWMxY
z!;8f6?Bc_|&${&XT%5h#bnBPh$;tL<rH`xi@yo97(s{ex+m)z%I_}`X>;Bc*#g*6O
z!TI^g>Zt3}PrrOIF3<hd$<lW}y<VNXy!^SprS~x%dgbAK*z&adPr77w7F_*r{Pk|D
zb=vIZ(|+3xmyh;~^B=rOH+}f)@?_a<mWf0D^x@H6xvzsK-TL_Pqr;z{Wj5PCciVqS
zZ}GF&r++NdodMhf*!_R7xbnsB$!{Oi;hin&)jB<ghY98K;!%1Uf22zv-uWN#@m@~E
GfB^to*P*)r

diff --git a/rowers/views/apiviews.py b/rowers/views/apiviews.py
index 8c214655..d383b3c5 100644
--- a/rowers/views/apiviews.py
+++ b/rowers/views/apiviews.py
@@ -2,7 +2,8 @@ from rowers.views.statements import *
 from rowers.tasks import handle_calctrimp
 from rowers.opaque import encoder
 from rowers.courses import coursetokml, coursestokml
-from xml.etree import ElementTree as ET
+#from xml.etree import ElementTree as ET
+from defusedxml import ElementTree as ET
 
 import arrow
 import pendulum
@@ -28,6 +29,8 @@ class XMLParser(BaseParser):
         dologging("apilog.log", "XML Parser")
         try:
             s = ET.parse(stream).getroot()
+        except ET.XMLSyntaxError:
+            return HttpResponse(status=400)
         except Exception as e: # pragma: no cover
             dologging("apilog.log",e)
             return HttpResponse(status=500)
diff --git a/rowers/weather.py b/rowers/weather.py
index c6533127..e7f2e0eb 100644
--- a/rowers/weather.py
+++ b/rowers/weather.py
@@ -2,7 +2,8 @@ import requests
 from requests.exceptions import ConnectionError
 import json
 from lxml import objectify, etree
-import xml.etree.ElementTree as ET
+#import xml.etree.ElementTree as ET
+from defusedxml import ElementTree as ET
 import time
 from datetime import datetime
 from rowingdata import rowingdata, geo_distance