From e006f4f4968c0df0c70f9d07578d49c6f1a741f2 Mon Sep 17 00:00:00 2001 From: root Date: Sat, 22 Aug 2026 22:59:51 +0000 Subject: [PATCH] fix(planning): validate room schedule provenance scope --- app_new/core/services/room_planning.py | 4 +++- app_new/planning/schedules.py | 3 ++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/app_new/core/services/room_planning.py b/app_new/core/services/room_planning.py index 956f443..a65b9f9 100644 --- a/app_new/core/services/room_planning.py +++ b/app_new/core/services/room_planning.py @@ -92,7 +92,9 @@ def sync_pronote_schedules(room_id, entries, *, synced_at=None): if not external_id: continue seen.add(external_id) - row = RoomSchedule.query.filter_by(source="pronote", external_id=external_id).first() + row = RoomSchedule.query.filter_by( + room_id=room_id, source="pronote", external_id=external_id + ).first() if not row: row = RoomSchedule(room_id=room_id, source="pronote", external_id=external_id) db.session.add(row) diff --git a/app_new/planning/schedules.py b/app_new/planning/schedules.py index d120471..e1dacc2 100644 --- a/app_new/planning/schedules.py +++ b/app_new/planning/schedules.py @@ -42,7 +42,8 @@ def room_schedule_new(): except (KeyError, TypeError, ValueError): flash('Salle, date et horaires sont obligatoires.', 'danger') return render_template('planning/room_schedule_form.html', rooms=rooms, schedule=None), 400 - if start_time >= end_time or not Room.query.get(room_id): + if (start_time >= end_time or not Room.query.get(room_id) + or day_of_week < 0 or day_of_week > 6): flash('Vérifiez la salle et l’ordre des horaires.', 'danger') return render_template('planning/room_schedule_form.html', rooms=rooms, schedule=None), 400 schedule = RoomSchedule(