Fix bulk edit validation: prevent duplicate findings from being active/verified#13965
Merged
valentijnscholten merged 4 commits intoDefectDojo:devfrom Dec 29, 2025
Merged
Conversation
…e/verified - Add validation in FindingBulkUpdateForm to prevent active findings from being risk accepted - Add view-level validation to check existing duplicate status before setting active/verified - Add view-level validation to check existing active status before risk accepting - Add comprehensive user feedback for skipped findings with reasons - Track actually_updated_count to accurately report successful updates Fixes DefectDojo#11336
github-actions
bot
added
docker
New Migration
github-actions
bot
removed
docker
New Migration
valentijnscholten
requested review from
Maffooch and
mtesauro
as code owners
Maffooch
approved these changes
Dec 25, 2025
blakeaowens
approved these changes
Dec 27, 2025
Jino-T
approved these changes
Dec 29, 2025
valentijnscholten
added a commit
to valentijnscholten/django-DefectDojo
that referenced
this pull request
Dec 29, 2025
…e/verified (DefectDojo#13965) * Fix bulk edit validation: prevent duplicate findings from being active/verified - Add validation in FindingBulkUpdateForm to prevent active findings from being risk accepted - Add view-level validation to check existing duplicate status before setting active/verified - Add view-level validation to check existing active status before risk accepting - Add comprehensive user feedback for skipped findings with reasons - Track actually_updated_count to accurately report successful updates Fixes DefectDojo#11336 * add bulk edit validation tests * bulk edit: reduce method complexity
Maffooch
pushed a commit
to valentijnscholten/django-DefectDojo
that referenced
this pull request
Feb 16, 2026
…e/verified (DefectDojo#13965) * Fix bulk edit validation: prevent duplicate findings from being active/verified - Add validation in FindingBulkUpdateForm to prevent active findings from being risk accepted - Add view-level validation to check existing duplicate status before setting active/verified - Add view-level validation to check existing active status before risk accepting - Add comprehensive user feedback for skipped findings with reasons - Track actually_updated_count to accurately report successful updates Fixes DefectDojo#11336 * add bulk edit validation tests * bulk edit: reduce method complexity
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes the bug where bulk edit allows duplicate findings to be marked as active/verified, which violates business rules enforced in the regular edit form and API. And it adds other validation rules that were missing from bulk edit.
AI helped me to create test cases. And then I extracted logic into separate methods to please Ruff.
Fixes #11336
Changes
Form Validation ()
FindingBulkUpdateForm.clean()to prevent active findings from being risk acceptedFindingFormbut was missing from the bulk formView Validation ()
actually_updated_countto accurately reflect findings that were actually updated (excluding skipped ones)Validation Rules Enforced
All validation rules from the API and regular forms are now enforced in bulk edit:
User Feedback
Users now receive clear feedback about: