From 438a73a5dc02e05d1824a2f4ae4a41a4a2c0a5d7 Mon Sep 17 00:00:00 2001 From: av-dev2 Date: Mon, 1 Jun 2026 12:13:01 +0300 Subject: [PATCH] fix: enforce HTTPS on API URLs and add timeout to NHIF token request - Add before_save validation to reject http:// URLs with a clear error message showing the corrected https:// URL - Strip trailing slashes from URL fields to prevent double-slash issues - Add 30s timeout to NHIF token request to prevent indefinite hangs --- .../doctype/hms_tz_setting/hms_tz_setting.py | 41 ++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/hms_tz/hms_tz/doctype/hms_tz_setting/hms_tz_setting.py b/hms_tz/hms_tz/doctype/hms_tz_setting/hms_tz_setting.py index ad586fdc..d2c22097 100644 --- a/hms_tz/hms_tz/doctype/hms_tz_setting/hms_tz_setting.py +++ b/hms_tz/hms_tz/doctype/hms_tz_setting/hms_tz_setting.py @@ -7,6 +7,7 @@ import frappe import requests +from frappe import _ from frappe.model.document import Document from frappe.utils import add_to_date, get_datetime, now_datetime @@ -15,6 +16,44 @@ class HMSTZSetting(Document): + def before_save(self): + self.validate_api_urls() + + def validate_api_urls(self): + """Enforce HTTPS and strip trailing slashes on all API URL fields.""" + + url_fields = [ + {"field": "nhif_token_url", "label": "NHIF Token URL"}, + {"field": "nhifservice_url", "label": "NHIF Service URL"}, + {"field": "nhif_claim_url", "label": "NHIF Claim URL"}, + {"field": "jubilee_url", "label": "Jubilee URL"}, + ] + + for entry in url_fields: + url = self.get(entry["field"]) + if not url: + continue + + url = url.strip().rstrip("/") + + if url.startswith("http://"): + frappe.throw( + _("{0} must use HTTPS. Please change {1} to {2}").format( + entry["label"], + url, + url.replace("http://", "https://", 1), + ), + title=_("Insecure URL"), + ) + + if not url.startswith("https://"): + frappe.throw( + _("{0} must start with https://").format(entry["label"]), + title=_("Invalid URL"), + ) + + self.set(entry["field"], url) + @frappe.whitelist() def get_nhif_token(self): if self.enable_nhif_api == 0: @@ -40,7 +79,7 @@ def get_nhif_token(self): for i in range(3): try: - r = requests.request("POST", url, headers=headers, data=payload) + r = requests.request("POST", url, headers=headers, data=payload, timeout=30) r.raise_for_status() data = json.loads(r.text)