Wrong keys in several requests causing Status 500 Errors

[ilomax]

Bug description I have been receiving 500 responses while performing different actions in DefectDojo. The two cases I have noticed for now are when logging out of my account, and upon deleting a group in the administration panel.

Steps to reproduce Steps to reproduce the behavior:

• Logout:

  1. Log in with AzureAD SSO.
  2. Just clicking the "Logout" button in the profile dropdown The error occurs whether the account is new or already existing.

• Group deletion:

  1. Go to /admin/auth/group/
  2. Select a group or click on it to inspect it
  3. Select the "Delete selected groups" action or click the "DELETE" button on the group's page

Expected behavior In the first case, the user should be disconnected and, I'm guessing, shown the login page. In the second one, the group should be deleted.

Deployment method (select with an X)

• [ ] Docker Compose
• [X] Kubernetes
• [ ] GoDojo

Environment information

• Version: 2.14.3 (also in 2.12.0)

Logs

• Logout:

  │| uwsgi [27/Sep/2022 08:39:07] ERROR [django.request:224] Internal Server Error: /login
  ││ uwsgi Traceback (most recent call last):
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/core/handlers/exception.py", line 47, in inner
  ││ uwsgi     response = get_response(request)
  │| uwsgi   File "/usr/local/lib/python3.8/site-packages/django/core/handlers/base.py", line 181, in _get_response
  ││ uwsgi     response = wrapped_callback(request, *callback_args, **callback_kwargs)
  │| uwsgi   File "/app/./dojo/decorators.py", line 186, in _wrapped
  ││ uwsgi     return fn(request, *args, **kw)
  ││ uwsgi   File "/app/./dojo/decorators.py", line 186, in _wrapped
  ││ uwsgi     return fn(request, *args, **kw)
  │| uwsgi   File "/app/./dojo/user/views.py", line 115, in login_view
  ││ uwsgi     urlencode({'next': request.GET.get('next')})))
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/utils/http.py", line 113, in urlencode
  ││ uwsgi     raise TypeError(
  │| uwsgi TypeError: Cannot encode None for key 'next' in a query string. Did you mean to pass an empty string or omit the value?

• Group deletion:

  || uwsgi [27/Sep/2022 08:43:53] ERROR [django.request:224] Internal Server Error: /admin/auth/group/
  ││ uwsgi Traceback (most recent call last):
  │| uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/fields/related_descriptors.py", line 173, in __get__
  │| uwsgi     rel_obj = self.field.get_cached_value(instance)
  │| uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/fields/mixins.py", line 15, in get_cached_value
  │| uwsgi     return instance._state.fields_cache[cache_name]
  │| uwsgi KeyError: 'auth_group'
  │| uwsgi During handling of the above exception, another exception occurred:
  │| uwsgi Traceback (most recent call last):
  │| uwsgi   File "/usr/local/lib/python3.8/site-packages/django/core/handlers/exception.py", line 47, in inner
  │| uwsgi     response = get_response(request)
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/core/handlers/base.py", line 181, in _get_response
  ││ uwsgi     response = wrapped_callback(request, *callback_args, **callback_kwargs)
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/contrib/admin/options.py", line 616, in wrapper
  ││ uwsgi     return self.admin_site.admin_view(view)(*args, **kwargs)
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/utils/decorators.py", line 130, in _wrapped_view
  ││ uwsgi     response = view_func(request, *args, **kwargs)
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/views/decorators/cache.py", line 44, in _wrapped_view_func
  ││ uwsgi     response = view_func(request, *args, **kwargs)
  ││ nginx 10.244.11.230 - - [27/Sep/2022:08:43:53 +0000] "POST /admin/auth/group/ HTTP/1.1" 500 145 "https://defectdojo.tools.XXXX.fr/admin/auth/group/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
  ││  "82.127.73.179"
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/contrib/admin/sites.py", line 232, in inner
  ││ uwsgi     return view(request, *args, **kwargs)
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/utils/decorators.py", line 43, in _wrapper
  ││ uwsgi     return bound_method(*args, **kwargs)
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/utils/decorators.py", line 130, in _wrapped_view
  ││ uwsgi     response = view_func(request, *args, **kwargs)
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/contrib/admin/options.py", line 1739, in changelist_view
  ││ uwsgi     response = self.response_action(request, queryset=cl.get_queryset(request))
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/contrib/admin/options.py", line 1408, in response_action
  ││ uwsgi     response = func(self, request, queryset)
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/contrib/admin/actions.py", line 45, in delete_selected
  ││ uwsgi     modeladmin.delete_queryset(request, queryset)
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/contrib/admin/options.py", line 1109, in delete_queryset
  ││ uwsgi     queryset.delete()
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/query.py", line 746, in delete
  ││ uwsgi     deleted, _rows_count = collector.delete()
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/deletion.py", line 435, in delete
  ││ uwsgi     signals.post_delete.send(
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/dispatch/dispatcher.py", line 180, in send
  ││ uwsgi     return [
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/dispatch/dispatcher.py", line 181, in <listcomp>
  ││ uwsgi     (receiver, receiver(signal=self, sender=sender, **named))
  ││ uwsgi   File "/app/./dojo/group/utils.py", line 68, in group_member_post_delete_handler
  ││ uwsgi     if group_member.group.auth_group:
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/fields/related_descriptors.py", line 187, in __get__
  ││ uwsgi     rel_obj = self.get_object(instance)
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/fields/related_descriptors.py", line 154, in get_object
  ││ uwsgi     return qs.get(self.field.get_reverse_related_filter(instance))
  ││ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/query.py", line 435, in get
  ││ uwsgi     raise self.model.DoesNotExist(
  ││ uwsgi django.contrib.auth.models.Group.DoesNotExist: Group matching query does not exist.

[coheigea]

Logout works correctly for me, have you configured it with SSO? Please give more information about reproducing.

[ilomax]

Thank you for your answer. That's my bad, the login process is indeed managed through Azure AD SSO. Please let me know if there is anymore information I can provide you with related to this.