Security Patches: IDOR and XSS Fixes

[arpit000010]

Changes Made:

1. Fixed IDOR / Account Takeover Vulnerability

• Issue: The LoginWithGoogleView API endpoint had a flaw where an attacker could create a Google account matching an existing username (e.g., admin) and hijack the account, receiving a valid JWT token for that user.
• Fix: Added validation in user_profile/api/views.py to ensure that if a matching username exists but the Google email doesn't match the database email, the login is rejected with a 403 Forbidden error.

2. Fixed Stored Cross-Site Scripting (XSS)

• Issue: Markdown inputs in the Forum, Blog, and Events models did not strip malicious HTML tags, allowing attackers to inject JavaScript (e.g., <script> tags).
• Fix: Installed the bleach and tinycss2 libraries. Implemented a sanitize_markdown utility function that safely strips malicious tags and attributes on the server-side before saving to the database.

3. Dependency Updates

• Added bleach[css]==6.2.0 and tinycss2==1.4.0 to requirements.txt.