Merged
Conversation
…he 'attachments' key of the .omd to its own file. The value of this key-value pair must be a string, or <file>.write() raises an Exception. Normally, every value is a string. However, the 'geojsonFiles' key has a dict as its value. Converting the value to a str() will have no impact on existing code but will prevent an exception from being raised if the GridLAB-D solver is run on an .omd file that contains the 'geojsonFiles' key.
…ccording to python convention
…imited to POST requests. This reduces the attack surface in web.py forecastTool.html - update call to /newModel to use POST request test_accessControl.py - update call to /newModel to use POST request
…nderscore according to python convention
clusterLogin.html - update /forgotPassword call from GET to POST distNetViz.html - update /renameFeeder calls from GET to POST web.py - reduce overall attack surface by strictly limiting web routes to their correct HTTP methods. E.g. sever-changing operations should always use POST so attackers can't attack a route through an <img> tag
…transEdit.html & web.py - switch ordering of /uniqObjName modelName and name parameters because semantically the modelName should always come before the name of a file within the model directory
… in RED-1930 report
dpinney-nreca
approved these changes
Apr 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added changes to secure filenames identified in RED-1930 report. Made minor style changes to make certain functions more obviously module-private, removed GET requests from a few routes that should be POST only and updated callers, added CSRF token to feeder map editor, reordered the /unqiqObjName route.