pinax / pinax-messages

a Django app for allowing users of your site to send messages to each other
MIT License
202 stars 58 forks source link

Add UUID Fields #52

Open tarsil opened 4 years ago

tarsil commented 4 years ago

Is your feature request related to a problem? Please describe. In order to implement security for an application that uses this package, a lot needs to be done, for instance, masking or obscuring the ID from the URL where it could easily be read as a DB entry.

An easy way to do it is to add UUID fields (type 4, for example uuid.uuid4()) into every model of the package.

Describe the solution you'd like Adding a UUID field to every model it would be easier to implement and "obscure" attempts of adultering the message in between.

Which benefits it would bring? Well, we don't need to inherit directly from the model to create our own just to add that field, instead, we could use it as a proxy table and that's it, the module could and can be upgraded minimizing the risk of breaking the inherited model as it lives in isolation as well we could protect the URLs with a more "non-understandable" identifier.

So in every model it would be like this:

import uuid as _uuid
....
....

class Thread(models.Model):
    uuid = models.UUIDField(editable=False, blank=False, null=False, default=_uuid.uuid4)
    ....

class UserThread(models.Model):
    uuid = models.UUIDField(editable=False, blank=False, null=False, default=_uuid.uuid4)
    ....

class Message(models.Model):
    uuid = models.UUIDField(editable=False, blank=False, null=False, default=_uuid.uuid4)
    ....

Describe alternatives you've considered