Skip to content

Conversation

@valentijnscholten
Copy link
Member

@valentijnscholten valentijnscholten commented Feb 10, 2026

Summary

Fixes #14281

This PR fixes a bug where active findings could not be risk accepted via the bulk edit menu, even though individual risk acceptance worked fine and simple risk acceptance was enabled on the product. This now matches the Pro UI.

Changes

  • Remove invalid restriction: Removed the check that prevented active findings from being risk accepted in bulk operations
  • Update tests: Modified test_bulk_edit_active_finding_can_accept_risk to verify that active findings can now be risk accepted successfully in bulk
  • Update test: Modified test_bulk_edit_shows_multiple_warning_messages to verify no warning appears when risk accepting active findings
  • Remove obsolete code: Removed the warning message about "active findings cannot be risk accepted"
  • Simplify return value: Updated _bulk_update_risk_acceptance helper function to return only the count of skipped findings

Root Cause

The bulk update function incorrectly checked if finding.active: and skipped risk acceptance for active findings, showing a warning message. However:

  1. The individual risk acceptance endpoint (simple_risk_accept view) has NO such restriction
  2. The simple_risk_accept helper function automatically sets finding.active = False when accepting risk
  3. DefectDojo Pro allows bulk risk acceptance of active findings

This was an inconsistency between bulk and individual operations that had no technical justification.

Behavior Change

Before: Bulk risk acceptance of active findings failed with error message "Active findings cannot be risk accepted"

After: Bulk risk acceptance of active findings works correctly, matching individual behavior. The finding becomes inactive (risk_accepted=True, active=False) after risk acceptance.

Allow simple risk acceptance of active findings via bulk edit menu,
matching the behavior of individual finding risk acceptance.

Previously, bulk risk acceptance incorrectly rejected active findings
with a warning message, even though individual risk acceptance worked
fine. This was inconsistent with DefectDojo Pro and the individual
risk acceptance feature.

Changes:
- Remove the check that prevented active findings from being risk
  accepted in bulk operations
- Update test to verify active findings can now be risk accepted
- Remove obsolete warning message about active findings
- Simplify return value of _bulk_update_risk_acceptance helper

The simple_risk_accept helper already handles setting finding.active
to False when accepting risk, so there's no need for an additional
check in the bulk update flow.
Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

(OS) Can't risk accept multiple Findings in the Bulk Edits menu

3 participants