📝(changelog) update changelog

Update changelog with PR's purpose
⬆️(backend) upgrade Django to address multiple high-severity CVEs
2026-02-05 19:12:46 +01:00 · 2026-02-05 19:12:15 +01:00 · 2026-02-05 19:12:15 +01:00 · 2026-02-05 19:12:15 +01:00 · 2026-02-05 19:12:15 +01:00 · 2026-02-05 19:12:15 +01:00
3 changed files with 19 additions and 3 deletions
@@ -13,6 +13,7 @@ and this project adheres to
 - ♿️(frontend) fix form labels and autocomplete wiring #932
 - 🥅(summary) catch file-related exceptions when handling recording #944
 - 📝(frontend) update legal terms #956
+- ⚡️(backend) enhance django admin's loading performance #954

 ## [1.5.0] - 2026-01-28

@@ -115,6 +115,10 @@ class RoomAdmin(admin.ModelAdmin):
    list_filter = ["access_level", "created_at"]
    readonly_fields = ["id", "created_at", "updated_at"]

+    def get_queryset(self, request):
+        """Optimize queries by prefetching related access and user data to avoid N+1 queries."""
+        return super().get_queryset(request).prefetch_related("accesses__user")
+
    def get_owner(self, obj):
        """Return the owner of the room for display in the admin list."""

@@ -138,6 +142,7 @@ class RecordingAccessInline(admin.TabularInline):

    model = models.RecordingAccess
    extra = 0
+    autocomplete_fields = ["user"]


@admin.action(description=_("Resend notification to external service"))
@@ -207,8 +212,18 @@ class RecordingAdmin(admin.ModelAdmin):
        "created_at",
        "worker_id",
    )
-    list_filter = ["status", "room", "created_at"]
-    readonly_fields = ["id", "created_at", "updated_at"]
+    list_filter = ["created_at"]
+    list_select_related = ("room",)
+    readonly_fields = (
+        "id",
+        "created_at",
+        "options",
+        "mode",
+        "room",
+        "status",
+        "updated_at",
+        "worker_id",
+    )
    actions = [resend_notification]

    def get_queryset(self, request):
@@ -38,7 +38,7 @@ dependencies = [
    "django-redis==6.0.0",
    "django-storages[s3]==1.14.6",
    "django-timezone-field>=5.1",
-    "django==5.2.9",
+    "django==5.2.11",
    "djangorestframework==3.16.1",
    "drf_spectacular==0.29.0",
    "dockerflow==2024.4.2",
Author	SHA1	Message	Date
lebaudantoine	ccf0f1d888	📝(changelog) update changelog Update changelog with PR's purpose	2026-02-05 19:12:46 +01:00
lebaudantoine	c01fcd5161	⬆️(backend) upgrade Django to address multiple high-severity CVEs This update fixes several SQL injection vulnerabilities, including issues in RasterField band index handling and crafted column aliases (notably in QuerySet.order_by()), as reported in CVE-2026-1207, CVE-2026-1287, and CVE-2026-1312.	2026-02-05 19:12:15 +01:00
lebaudantoine	014537aca7	⚡️(admin) improve recording access select component performance Replace the basic select component that loaded thousands of options into the DOM with a smarter component supporting dynamic loading and search. With large user bases, linking users to recording access caused massive option lists to render, severely impacting performance. This change dramatically improves page loading speed.	2026-02-05 19:12:15 +01:00
lebaudantoine	cfd5ee2a53	🔒️(admin) make recording fields read-only for security and performance These values should not be updated from the admin interface. Allowing changes to a recording’s associated room could lead to data leaks (e.g., notifications being resent to the wrong users after a malicious modification). Also remove the room select field, which rendered a dropdown with ~150k options, flooding the DOM and severely degrading page performance.	2026-02-05 19:12:15 +01:00
lebaudantoine	5a1df3dc4f	⚡️(admin) optimize room view queries by prefetching user access Use prefetch_related for the room–user access relationship to avoid N+1 queries. select_related cannot be used here since this is a many-to-many relation. This significantly improves performance.	2026-02-05 19:12:15 +01:00
lebaudantoine	c46123cb16	⚡️(admin) optimize recording view by selecting room at the SQL level Use select_related on the room foreign key to avoid N+1 queries. This makes Django perform a join between tables instead of triggering additional queries per row, reducing complexity from O(n²) patterns to O(n) and significantly improving performance.	2026-02-05 19:12:15 +01:00
lebaudantoine	81f328c77d	⚡️(admin) remove list filters based on room in recording view This was a mistake: the filter was never used in production and caused performance issues. It generated a list of unique room slugs, bloating the DOM with thousands of values and slowing down view rendering. Remove this regression.	2026-02-05 19:12:15 +01:00