refactor: optimize get_object_or_404 calls for Engagement and Engagement_Presets

Author: Maffooch

dojo/engagement/views.py

@@ -1377,7 +1377,7 @@ def edit_risk_acceptance(request, eid, raid):
 # will only be called by view_risk_acceptance and edit_risk_acceptance
 def view_edit_risk_acceptance(request, eid, raid, *, edit_mode=False):
     risk_acceptance = get_object_or_404(Risk_Acceptance, pk=raid)
-    eng = get_object_or_404(Engagement, pk=eid)
+    eng = get_object_or_404(Engagement.objects.filter(risk_acceptance=risk_acceptance), pk=eid)
 
     if edit_mode and not eng.product.enable_full_risk_acceptance:
         raise PermissionDenied
@@ -1538,7 +1538,7 @@ def view_edit_risk_acceptance(request, eid, raid, *, edit_mode=False):
 def expire_risk_acceptance(request, eid, raid):
     risk_acceptance = get_object_or_404(prefetch_for_expiration(Risk_Acceptance.objects.all()), pk=raid)
     # Validate the engagement ID exists before moving forward
-    get_object_or_404(Engagement, pk=eid)
+    get_object_or_404(Engagement.objects.filter(risk_acceptance=risk_acceptance), pk=eid)
 
     ra_helper.expire_now(risk_acceptance)
 
@@ -1548,8 +1548,7 @@ def expire_risk_acceptance(request, eid, raid):
 @user_is_authorized(Engagement, Permissions.Risk_Acceptance, "eid")
 def reinstate_risk_acceptance(request, eid, raid):
     risk_acceptance = get_object_or_404(prefetch_for_expiration(Risk_Acceptance.objects.all()), pk=raid)
-    eng = get_object_or_404(Engagement, pk=eid)
-
+    eng = get_object_or_404(Engagement.objects.filter(risk_acceptance=risk_acceptance), pk=eid)
     if not eng.product.enable_full_risk_acceptance:
         raise PermissionDenied
 
@@ -1561,8 +1560,7 @@ def reinstate_risk_acceptance(request, eid, raid):
 @user_is_authorized(Engagement, Permissions.Risk_Acceptance, "eid")
 def delete_risk_acceptance(request, eid, raid):
     risk_acceptance = get_object_or_404(Risk_Acceptance, pk=raid)
-    eng = get_object_or_404(Engagement, pk=eid)
-
+    eng = get_object_or_404(Engagement.objects.filter(risk_acceptance=risk_acceptance), pk=eid)
     ra_helper.delete(eng, risk_acceptance)
 
     messages.add_message(

dojo/product/views.py

@@ -1597,7 +1597,7 @@ def engagement_presets(request, pid):
 @user_is_authorized(Product, Permissions.Product_Edit, "pid")
 def edit_engagement_presets(request, pid, eid):
     prod = get_object_or_404(Product, id=pid)
-    preset = get_object_or_404(Engagement_Presets, id=eid)
+    preset = get_object_or_404(Engagement_Presets.objects.filter(product=prod), id=eid)
 
     product_tab = Product_Tab(prod, title=_("Edit Engagement Preset"), tab="settings")
 
@@ -1646,7 +1646,7 @@ def add_engagement_presets(request, pid):
 @user_is_authorized(Product, Permissions.Product_Edit, "pid")
 def delete_engagement_presets(request, pid, eid):
     prod = get_object_or_404(Product, id=pid)
-    preset = get_object_or_404(Engagement_Presets, id=eid)
+    preset = get_object_or_404(Engagement_Presets.objects.filter(product=prod), id=eid)
     form = DeleteEngagementPresetsForm(instance=preset)
 
     if request.method == "POST":