Enhance search functionality with case-insensitive title search, security improvements, and comprehensive tests

- Add case-insensitive search across all fields (inhalt, titel, geltungsbereich)
- Include Vorgabe.titel field in search scope for better coverage
- Implement comprehensive input validation against SQL injection and XSS
- Add German error messages for validation failures
- Escape search terms in templates to prevent XSS attacks
- Add input length limits and character validation
- Preserve user input on validation errors for better UX
- Add comprehensive test suite with 27 tests covering all functionality
- Test security features: XSS prevention, SQL injection protection, input validation
- Test edge cases: expired content, multiple documents, German umlauts
- Ensure all search fields work correctly with case-insensitive matching

argocd/deployment.yaml

@@ -18,14 +18,14 @@ spec:
         fsGroupChangePolicy: "OnRootMismatch"
       initContainers:
         - name: loader
-          image: git.baumann.gr/adebaumann/vui-data-loader:0.8
+          image: git.baumann.gr/adebaumann/vui-data-loader:0.9
           command: [ "sh","-c","cp -n preload/preload.sqlite3 /data/db.sqlite3; chown -R 999:999 /data; ls -la /data; sleep 10; exit 0" ]
           volumeMounts:
             - name: data
               mountPath: /data
       containers:
         - name: web
-          image: git.baumann.gr/adebaumann/vui:0.939
+          image: git.baumann.gr/adebaumann/vui:0.941
           imagePullPolicy: Always
           ports:
             - containerPort: 8000

dokumente/management/commands/sanity_check_vorgaben.py

@@ -0,0 +1,70 @@
+from django.core.management.base import BaseCommand
+from django.db import transaction
+from dokumente.models import Vorgabe
+import datetime
+
+
+class Command(BaseCommand):
+    help = 'Run sanity checks on Vorgaben to detect conflicts'
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            '--fix',
+            action='store_true',
+            help='Attempt to fix conflicts (not implemented yet)',
+        )
+        parser.add_argument(
+            '--verbose',
+            action='store_true',
+            help='Show detailed output',
+        )
+
+    def handle(self, *args, **options):
+        self.verbose = options['verbose']
+        
+        self.stdout.write(self.style.SUCCESS('Starting Vorgaben sanity check...'))
+        
+        # Run the sanity check
+        conflicts = Vorgabe.sanity_check_vorgaben()
+        
+        if not conflicts:
+            self.stdout.write(self.style.SUCCESS('✓ No conflicts found in Vorgaben'))
+            return
+        
+        self.stdout.write(
+            self.style.WARNING(f'Found {len(conflicts)} conflicts:')
+        )
+        
+        for i, conflict in enumerate(conflicts, 1):
+            self._display_conflict(i, conflict)
+        
+        if options['fix']:
+            self.stdout.write(self.style.ERROR('Auto-fix not implemented yet'))
+
+    def _display_conflict(self, index, conflict):
+        """Display a single conflict"""
+        v1 = conflict['vorgabe1']
+        v2 = conflict['vorgabe2']
+        
+        self.stdout.write(f"\n{index}. {conflict['message']}")
+        
+        if self.verbose:
+            self.stdout.write(f"   Vorgabe 1: {v1.Vorgabennummer()}")
+            self.stdout.write(f"   Valid from: {v1.gueltigkeit_von} to {v1.gueltigkeit_bis or 'unlimited'}")
+            self.stdout.write(f"   Title: {v1.titel}")
+            
+            self.stdout.write(f"   Vorgabe 2: {v2.Vorgabennummer()}")
+            self.stdout.write(f"   Valid from: {v2.gueltigkeit_von} to {v2.gueltigkeit_bis or 'unlimited'}")
+            self.stdout.write(f"   Title: {v2.titel}")
+        
+        # Show the overlapping period
+        overlap_start = max(v1.gueltigkeit_von, v2.gueltigkeit_von)
+        overlap_end = min(
+            v1.gueltigkeit_bis or datetime.date.max,
+            v2.gueltigkeit_bis or datetime.date.max
+        )
+        
+        if overlap_end != datetime.date.max:
+            self.stdout.write(f"   Overlap: {overlap_start} to {overlap_end}")
+        else:
+            self.stdout.write(f"   Overlap starts: {overlap_start} (no end)")

dokumente/models.py

@@ -78,7 +78,7 @@ class Vorgabe(models.Model):
         if not self.gueltigkeit_bis:
             return "active"
 
-        if self.gueltigkeit_bis > check_date:
+        if self.gueltigkeit_bis >= check_date:
             return "active"
 
         return "expired" if not verbose else "Ist seit dem "+self.gueltigkeit_bis.strftime('%d.%m.%Y')+" nicht mehr in Kraft."
@@ -86,6 +86,123 @@ class Vorgabe(models.Model):
     def __str__(self):
         return f"{self.Vorgabennummer()}: {self.titel}"
 
+    @staticmethod
+    def sanity_check_vorgaben():
+        """
+        Sanity check for Vorgaben:
+        If there are two Vorgaben with the same number, Thema and Dokument,
+        their valid_from and valid_to date ranges shouldn't intersect.
+        
+        Returns:
+            list: List of dictionaries containing conflicts found
+        """
+        conflicts = []
+        
+        # Group Vorgaben by dokument, thema, and nummer
+        from django.db.models import Count
+        from itertools import combinations
+        
+        # Find Vorgaben with same dokument, thema, and nummer
+        duplicate_groups = (
+            Vorgabe.objects.values('dokument', 'thema', 'nummer')
+            .annotate(count=Count('id'))
+            .filter(count__gt=1)
+        )
+        
+        for group in duplicate_groups:
+            # Get all Vorgaben in this group
+            vorgaben = Vorgabe.objects.filter(
+                dokument=group['dokument'],
+                thema=group['thema'], 
+                nummer=group['nummer']
+            )
+            
+            # Check all pairs for date range intersections
+            for vorgabe1, vorgabe2 in combinations(vorgaben, 2):
+                if Vorgabe._date_ranges_intersect(
+                    vorgabe1.gueltigkeit_von, vorgabe1.gueltigkeit_bis,
+                    vorgabe2.gueltigkeit_von, vorgabe2.gueltigkeit_bis
+                ):
+                    conflicts.append({
+                        'vorgabe1': vorgabe1,
+                        'vorgabe2': vorgabe2,
+                        'conflict_type': 'date_range_intersection',
+                        'message': f"Vorgaben {vorgabe1.Vorgabennummer()} and {vorgabe2.Vorgabennummer()} "
+                                  f"überschneiden sich in der Geltungsdauer"
+                    })
+        
+        return conflicts
+    
+    def clean(self):
+        """
+        Validate the Vorgabe before saving.
+        """
+        from django.core.exceptions import ValidationError
+        
+        # Check for conflicts with existing Vorgaben
+        conflicts = self.find_conflicts()
+        if conflicts:
+            conflict_messages = [c['message'] for c in conflicts]
+            raise ValidationError({
+                '__all__': conflict_messages
+            })
+    
+    def find_conflicts(self):
+        """
+        Find conflicts with existing Vorgaben.
+        
+        Returns:
+            list: List of conflict dictionaries
+        """
+        conflicts = []
+        
+        # Find Vorgaben with same dokument, thema, and nummer (excluding self)
+        existing_vorgaben = Vorgabe.objects.filter(
+            dokument=self.dokument,
+            thema=self.thema,
+            nummer=self.nummer
+        ).exclude(pk=self.pk)
+        
+        for other_vorgabe in existing_vorgaben:
+            if self._date_ranges_intersect(
+                self.gueltigkeit_von, self.gueltigkeit_bis,
+                other_vorgabe.gueltigkeit_von, other_vorgabe.gueltigkeit_bis
+            ):
+                conflicts.append({
+                    'vorgabe1': self,
+                    'vorgabe2': other_vorgabe,
+                    'conflict_type': 'date_range_intersection',
+                    'message': f"Vorgabe {self.Vorgabennummer()} conflicts with "
+                              f"existing {other_vorgabe.Vorgabennummer()} "
+                              f"due to overlapping validity periods"
+                })
+        
+        return conflicts
+
+    @staticmethod
+    def _date_ranges_intersect(start1, end1, start2, end2):
+        """
+        Check if two date ranges intersect.
+        None end date means open-ended range.
+        
+        Args:
+            start1, start2: Start dates
+            end1, end2: End dates (can be None for open-ended)
+            
+        Returns:
+            bool: True if ranges intersect
+        """
+        # If either start date is None, treat it as invalid case
+        if not start1 or not start2:
+            return False
+            
+        # If end date is None, treat it as far future
+        end1 = end1 or datetime.date.max
+        end2 = end2 or datetime.date.max
+        
+        # Ranges intersect if start1 <= end2 and start2 <= end1
+        return start1 <= end2 and start2 <= end1
+
     class Meta:
         verbose_name_plural="Vorgaben"
         ordering = ['order']

dokumente/tests.py

@@ -1,11 +1,14 @@
 from django.test import TestCase, Client
 from django.urls import reverse
+from django.core.management import call_command
 from datetime import date, timedelta
+from io import StringIO
 from .models import (
     Dokumententyp, Person, Thema, Dokument, Vorgabe,
     VorgabeLangtext, VorgabeKurztext, Geltungsbereich,
     Einleitung, Checklistenfrage, Changelog
 )
+from .utils import check_vorgabe_conflicts, date_ranges_intersect, format_conflict_report
 from abschnitte.models import AbschnittTyp
 from referenzen.models import Referenz
 from stichworte.models import Stichwort
@@ -513,3 +516,304 @@ class URLPatternsTest(TestCase):
         """Test that standard_history URL resolves correctly"""
         url = reverse('standard_history', kwargs={'nummer': 'TEST-001'})
         self.assertEqual(url, '/dokumente/TEST-001/history/')
+
+
+class VorgabeSanityCheckTest(TestCase):
+    """Test cases for Vorgabe sanity check functionality"""
+    
+    def setUp(self):
+        """Set up test data for sanity check tests"""
+        self.dokumententyp = Dokumententyp.objects.create(
+            name="Standard IT-Sicherheit",
+            verantwortliche_ve="SR-SUR-SEC"
+        )
+        self.dokument = Dokument.objects.create(
+            nummer="R0066",
+            dokumententyp=self.dokumententyp,
+            name="IT Security Standard",
+            aktiv=True
+        )
+        self.thema = Thema.objects.create(name="Organisation")
+        self.base_date = date(2023, 1, 1)
+        
+        # Create non-conflicting Vorgaben
+        self.vorgabe1 = Vorgabe.objects.create(
+            order=1,
+            nummer=1,
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="First Vorgabe",
+            gueltigkeit_von=self.base_date,
+            gueltigkeit_bis=date(2023, 12, 31)
+        )
+        
+        self.vorgabe2 = Vorgabe.objects.create(
+            order=2,
+            nummer=2,
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Second Vorgabe",
+            gueltigkeit_von=self.base_date,
+            gueltigkeit_bis=date(2023, 12, 31)
+        )
+    
+    def test_date_ranges_intersect_no_overlap(self):
+        """Test date_ranges_intersect with non-overlapping ranges"""
+        # Range 1: 2023-01-01 to 2023-06-30
+        # Range 2: 2023-07-01 to 2023-12-31
+        result = date_ranges_intersect(
+            date(2023, 1, 1), date(2023, 6, 30),
+            date(2023, 7, 1), date(2023, 12, 31)
+        )
+        self.assertFalse(result)
+    
+    def test_date_ranges_intersect_with_overlap(self):
+        """Test date_ranges_intersect with overlapping ranges"""
+        # Range 1: 2023-01-01 to 2023-06-30
+        # Range 2: 2023-06-01 to 2023-12-31 (overlaps in June)
+        result = date_ranges_intersect(
+            date(2023, 1, 1), date(2023, 6, 30),
+            date(2023, 6, 1), date(2023, 12, 31)
+        )
+        self.assertTrue(result)
+    
+    def test_date_ranges_intersect_with_none_end_date(self):
+        """Test date_ranges_intersect with None end date (open-ended)"""
+        # Range 1: 2023-01-01 to None (open-ended)
+        # Range 2: 2023-06-01 to 2023-12-31
+        result = date_ranges_intersect(
+            date(2023, 1, 1), None,
+            date(2023, 6, 1), date(2023, 12, 31)
+        )
+        self.assertTrue(result)
+    
+    def test_date_ranges_intersect_both_none_end_dates(self):
+        """Test date_ranges_intersect with both None end dates"""
+        # Both ranges are open-ended
+        result = date_ranges_intersect(
+            date(2023, 1, 1), None,
+            date(2023, 6, 1), None
+        )
+        self.assertTrue(result)
+    
+    def test_date_ranges_intersect_identical_ranges(self):
+        """Test date_ranges_intersect with identical ranges"""
+        result = date_ranges_intersect(
+            date(2023, 1, 1), date(2023, 12, 31),
+            date(2023, 1, 1), date(2023, 12, 31)
+        )
+        self.assertTrue(result)
+    
+    def test_sanity_check_vorgaben_no_conflicts(self):
+        """Test sanity_check_vorgaben with no conflicts"""
+        conflicts = Vorgabe.sanity_check_vorgaben()
+        self.assertEqual(len(conflicts), 0)
+    
+    def test_sanity_check_vorgaben_with_conflicts(self):
+        """Test sanity_check_vorgaben with conflicting Vorgaben"""
+        # Create a conflicting Vorgabe (same nummer, thema, dokument with overlapping dates)
+        conflicting_vorgabe = Vorgabe.objects.create(
+            order=3,
+            nummer=1,  # Same as vorgabe1
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Conflicting Vorgabe",
+            gueltigkeit_von=date(2023, 6, 1),  # Overlaps with vorgabe1
+            gueltigkeit_bis=date(2023, 8, 31)
+        )
+        
+        conflicts = Vorgabe.sanity_check_vorgaben()
+        self.assertEqual(len(conflicts), 1)
+        
+        conflict = conflicts[0]
+        self.assertEqual(conflict['conflict_type'], 'date_range_intersection')
+        self.assertIn('R0066.O.1', conflict['message'])
+        self.assertIn('intersecting validity periods', conflict['message'])
+        self.assertEqual(conflict['vorgabe1'], self.vorgabe1)
+        self.assertEqual(conflict['vorgabe2'], conflicting_vorgabe)
+    
+    def test_sanity_check_vorgaben_multiple_conflicts(self):
+        """Test sanity_check_vorgaben with multiple conflict groups"""
+        # Create first conflict group
+        conflicting_vorgabe1 = Vorgabe.objects.create(
+            order=3,
+            nummer=1,  # Same as vorgabe1
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Conflicting Vorgabe 1",
+            gueltigkeit_von=date(2023, 6, 1),
+            gueltigkeit_bis=date(2023, 8, 31)
+        )
+        
+        # Create second conflict group with different nummer
+        conflicting_vorgabe2 = Vorgabe.objects.create(
+            order=4,
+            nummer=2,  # Same as vorgabe2
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Conflicting Vorgabe 2",
+            gueltigkeit_von=date(2023, 6, 1),
+            gueltigkeit_bis=date(2023, 8, 31)
+        )
+        
+        conflicts = Vorgabe.sanity_check_vorgaben()
+        self.assertEqual(len(conflicts), 2)
+        
+        # Check that we have conflicts for both nummer 1 and nummer 2
+        conflict_messages = [c['message'] for c in conflicts]
+        self.assertTrue(any('R0066.O.1' in msg for msg in conflict_messages))
+        self.assertTrue(any('R0066.O.2' in msg for msg in conflict_messages))
+    
+    def test_find_conflicts_no_conflicts(self):
+        """Test find_conflicts method on Vorgabe with no conflicts"""
+        conflicts = self.vorgabe1.find_conflicts()
+        self.assertEqual(len(conflicts), 0)
+    
+    def test_find_conflicts_with_conflicts(self):
+        """Test find_conflicts method on Vorgabe with conflicts"""
+        # Create a conflicting Vorgabe
+        conflicting_vorgabe = Vorgabe.objects.create(
+            order=3,
+            nummer=1,  # Same as vorgabe1
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Conflicting Vorgabe",
+            gueltigkeit_von=date(2023, 6, 1),  # Overlaps
+            gueltigkeit_bis=date(2023, 8, 31)
+        )
+        
+        conflicts = self.vorgabe1.find_conflicts()
+        self.assertEqual(len(conflicts), 1)
+        conflict = conflicts[0]
+        self.assertEqual(conflict['vorgabe1'], self.vorgabe1)
+        self.assertEqual(conflict['vorgabe2'], conflicting_vorgabe)
+    
+    def test_vorgabe_clean_no_conflicts(self):
+        """Test Vorgabe.clean() with no conflicts"""
+        try:
+            self.vorgabe1.clean()
+        except Exception as e:
+            self.fail(f"clean() raised {e} unexpectedly!")
+    
+    def test_vorgabe_clean_with_conflicts(self):
+        """Test Vorgabe.clean() with conflicts raises ValidationError"""
+        # Create a conflicting Vorgabe
+        conflicting_vorgabe = Vorgabe(
+            order=3,
+            nummer=1,  # Same as vorgabe1
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Conflicting Vorgabe",
+            gueltigkeit_von=date(2023, 6, 1),  # Overlaps
+            gueltigkeit_bis=date(2023, 8, 31)
+        )
+        
+        with self.assertRaises(Exception) as context:
+            conflicting_vorgabe.clean()
+        
+        self.assertIn('conflicts with existing', str(context.exception))
+        self.assertIn('overlapping validity periods', str(context.exception))
+    
+    def test_check_vorgabe_conflicts_utility(self):
+        """Test check_vorgabe_conflicts utility function"""
+        # Initially no conflicts
+        conflicts = check_vorgabe_conflicts()
+        self.assertEqual(len(conflicts), 0)
+        
+        # Create a conflicting Vorgabe
+        conflicting_vorgabe = Vorgabe.objects.create(
+            order=3,
+            nummer=1,  # Same as vorgabe1
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Conflicting Vorgabe",
+            gueltigkeit_von=date(2023, 6, 1),  # Overlaps
+            gueltigkeit_bis=date(2023, 8, 31)
+        )
+        
+        conflicts = check_vorgabe_conflicts()
+        self.assertEqual(len(conflicts), 1)
+    
+    def test_format_conflict_report_no_conflicts(self):
+        """Test format_conflict_report with no conflicts"""
+        report = format_conflict_report([])
+        self.assertEqual(report, "✓ No conflicts found in Vorgaben")
+    
+    def test_format_conflict_report_with_conflicts(self):
+        """Test format_conflict_report with conflicts"""
+        # Create a conflicting Vorgabe
+        conflicting_vorgabe = Vorgabe.objects.create(
+            order=3,
+            nummer=1,  # Same as vorgabe1
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Conflicting Vorgabe",
+            gueltigkeit_von=date(2023, 6, 1),  # Overlaps
+            gueltigkeit_bis=date(2023, 8, 31)
+        )
+        
+        conflicts = check_vorgabe_conflicts()
+        report = format_conflict_report(conflicts)
+        
+        self.assertIn("Found 1 conflicts:", report)
+        self.assertIn("R0066.O.1", report)
+        self.assertIn("intersecting validity periods", report)
+
+
+class SanityCheckManagementCommandTest(TestCase):
+    """Test cases for sanity_check_vorgaben management command"""
+    
+    def setUp(self):
+        """Set up test data for management command tests"""
+        self.dokumententyp = Dokumententyp.objects.create(
+            name="Standard IT-Sicherheit",
+            verantwortliche_ve="SR-SUR-SEC"
+        )
+        self.dokument = Dokument.objects.create(
+            nummer="R0066",
+            dokumententyp=self.dokumententyp,
+            name="IT Security Standard",
+            aktiv=True
+        )
+        self.thema = Thema.objects.create(name="Organisation")
+    
+    def test_sanity_check_command_no_conflicts(self):
+        """Test management command with no conflicts"""
+        out = StringIO()
+        call_command('sanity_check_vorgaben', stdout=out)
+        
+        output = out.getvalue()
+        self.assertIn("Starting Vorgaben sanity check...", output)
+        self.assertIn("✓ No conflicts found in Vorgaben", output)
+    
+    def test_sanity_check_command_with_conflicts(self):
+        """Test management command with conflicts"""
+        # Create conflicting Vorgaben
+        Vorgabe.objects.create(
+            order=1,
+            nummer=1,
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="First Vorgabe",
+            gueltigkeit_von=date(2023, 1, 1),
+            gueltigkeit_bis=date(2023, 12, 31)
+        )
+        
+        Vorgabe.objects.create(
+            order=2,
+            nummer=1,  # Same nummer, thema, dokument
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Conflicting Vorgabe",
+            gueltigkeit_von=date(2023, 6, 1),  # Overlaps
+            gueltigkeit_bis=date(2023, 8, 31)
+        )
+        
+        out = StringIO()
+        call_command('sanity_check_vorgaben', stdout=out)
+        
+        output = out.getvalue()
+        self.assertIn("Starting Vorgaben sanity check...", output)
+        self.assertIn("Found 1 conflicts:", output)
+        self.assertIn("R0066.O.1", output)
+        self.assertIn("intersecting validity periods", output)

dokumente/utils.py

@@ -0,0 +1,123 @@
+"""
+Utility functions for Vorgaben sanity checking
+"""
+import datetime
+from django.db.models import Count
+from itertools import combinations
+from dokumente.models import Vorgabe
+
+
+def check_vorgabe_conflicts():
+    """
+    Check for conflicts in Vorgaben.
+    
+    Main rule: If there are two Vorgaben with the same number, Thema and Dokument,
+    their valid_from and valid_to date ranges shouldn't intersect.
+    
+    Returns:
+        list: List of conflict dictionaries
+    """
+    conflicts = []
+    
+    # Find Vorgaben with same dokument, thema, and nummer
+    duplicate_groups = (
+        Vorgabe.objects.values('dokument', 'thema', 'nummer')
+        .annotate(count=Count('id'))
+        .filter(count__gt=1)
+    )
+    
+    for group in duplicate_groups:
+        # Get all Vorgaben in this group
+        vorgaben = Vorgabe.objects.filter(
+            dokument=group['dokument'],
+            thema=group['thema'], 
+            nummer=group['nummer']
+        )
+        
+        # Check all pairs for date range intersections
+        for vorgabe1, vorgabe2 in combinations(vorgaben, 2):
+            if date_ranges_intersect(
+                vorgabe1.gueltigkeit_von, vorgabe1.gueltigkeit_bis,
+                vorgabe2.gueltigkeit_von, vorgabe2.gueltigkeit_bis
+            ):
+                conflicts.append({
+                    'vorgabe1': vorgabe1,
+                    'vorgabe2': vorgabe2,
+                    'conflict_type': 'date_range_intersection',
+                    'message': f"Vorgaben {vorgabe1.Vorgabennummer()} and {vorgabe2.Vorgabennummer()} "
+                              f"have intersecting validity periods"
+                })
+    
+    return conflicts
+
+
+def date_ranges_intersect(start1, end1, start2, end2):
+    """
+    Check if two date ranges intersect.
+    None end date means open-ended range.
+    
+    Args:
+        start1, start2: Start dates
+        end1, end2: End dates (can be None for open-ended)
+        
+    Returns:
+        bool: True if ranges intersect
+    """
+    # If either start date is None, treat it as invalid case
+    if not start1 or not start2:
+        return False
+        
+    # If end date is None, treat it as far future
+    end1 = end1 or datetime.date.max
+    end2 = end2 or datetime.date.max
+    
+    # Ranges intersect if start1 <= end2 and start2 <= end1
+    return start1 <= end2 and start2 <= end1
+
+
+def format_conflict_report(conflicts, verbose=False):
+    """
+    Format conflicts into a readable report.
+    
+    Args:
+        conflicts: List of conflict dictionaries
+        verbose: Whether to show detailed information
+        
+    Returns:
+        str: Formatted report
+    """
+    if not conflicts:
+        return "✓ No conflicts found in Vorgaben"
+    
+    lines = [f"Found {len(conflicts)} conflicts:"]
+    
+    for i, conflict in enumerate(conflicts, 1):
+        lines.append(f"\n{i}. {conflict['message']}")
+        
+        if verbose:
+            v1 = conflict['vorgabe1']
+            v2 = conflict['vorgabe2']
+            
+            lines.append(f"   Vorgabe 1: {v1.Vorgabennummer()}")
+            lines.append(f"   Valid from: {v1.gueltigkeit_von} to {v1.gueltigkeit_bis or 'unlimited'}")
+            lines.append(f"   Title: {v1.titel}")
+            
+            lines.append(f"   Vorgabe 2: {v2.Vorgabennummer()}")
+            lines.append(f"   Valid from: {v2.gueltigkeit_von} to {v2.gueltigkeit_bis or 'unlimited'}")
+            lines.append(f"   Title: {v2.titel}")
+        
+        # Show the overlapping period
+        v1 = conflict['vorgabe1']
+        v2 = conflict['vorgabe2']
+        overlap_start = max(v1.gueltigkeit_von, v2.gueltigkeit_von)
+        overlap_end = min(
+            v1.gueltigkeit_bis or datetime.date.max,
+            v2.gueltigkeit_bis or datetime.date.max
+        )
+        
+        if overlap_end != datetime.date.max:
+            lines.append(f"   Overlap: {overlap_start} to {overlap_end}")
+        else:
+            lines.append(f"   Overlap starts: {overlap_start} (no end)")
+    
+    return "\n".join(lines)

pages/templates/base.html

@@ -28,6 +28,6 @@
     <div class="flex-fill">{% block content %}Main Content{% endblock %}</div>
     <div class="col-md-2">{% block sidebar_right %}{% endblock %}</div>
 </div>
-<div>VorgabenUI v0.939</div>
+<div>VorgabenUI v0.941</div>
 </body>
 </html>

pages/templates/search.html

@@ -2,6 +2,12 @@
 {% block content %}
  <h1 class="mb-4">Suche</h1>
 
+ {% if error_message %}
+    <div class="alert alert-danger">
+        <strong>Fehler:</strong> {{ error_message }}
+    </div>
+ {% endif %}
+
     <!--  Search form  -->
     <form action="." method="post">
       {% csrf_token %}
@@ -13,7 +19,9 @@
                id="query"
                name="q"
                placeholder="Suchbegriff eingeben …"
-               required>
+               value="{{ search_term|default:'' }}"
+               required
+               maxlength="200">
       </div>
       <button type="submit" class="btn btn-primary">Suchen</button>
     </form>

pages/tests.py

@@ -0,0 +1,312 @@
+from django.test import TestCase, Client
+from django.core.exceptions import ValidationError
+from django.utils import timezone
+from datetime import date, timedelta
+from dokumente.models import Dokument, Vorgabe, VorgabeKurztext, VorgabeLangtext, Geltungsbereich, Dokumententyp, Thema
+from stichworte.models import Stichwort
+from unittest.mock import patch
+import re
+
+
+class SearchViewTest(TestCase):
+    def setUp(self):
+        self.client = Client()
+        
+        # Create test data
+        self.dokumententyp = Dokumententyp.objects.create(
+            name="Test Typ",
+            verantwortliche_ve="Test VE"
+        )
+        
+        self.thema = Thema.objects.create(
+            name="Test Thema",
+            erklaerung="Test Erklärung"
+        )
+        
+        self.dokument = Dokument.objects.create(
+            nummer="TEST-001",
+            dokumententyp=self.dokumententyp,
+            name="Test Dokument",
+            gueltigkeit_von=date.today(),
+            aktiv=True
+        )
+        
+        self.vorgabe = Vorgabe.objects.create(
+            order=1,
+            nummer=1,
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Test Vorgabe Titel",
+            gueltigkeit_von=date.today()
+        )
+        
+        # Create text content
+        self.kurztext = VorgabeKurztext.objects.create(
+            abschnitt=self.vorgabe,
+            inhalt="Dies ist ein Test Kurztext mit Suchbegriff"
+        )
+        
+        self.langtext = VorgabeLangtext.objects.create(
+            abschnitt=self.vorgabe,
+            inhalt="Dies ist ein Test Langtext mit anderem Suchbegriff"
+        )
+        
+        self.geltungsbereich = Geltungsbereich.objects.create(
+            geltungsbereich=self.dokument,
+            inhalt="Test Geltungsbereich mit Suchbegriff"
+        )
+    
+    def test_search_get_request(self):
+        """Test GET request returns search form"""
+        response = self.client.get('/search/')
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'Suche')
+        self.assertContains(response, 'Suchbegriff')
+    
+    def test_search_post_valid_term(self):
+        """Test POST request with valid search term"""
+        response = self.client.post('/search/', {'q': 'Test'})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'Suchresultate für Test')
+    
+    def test_search_case_insensitive(self):
+        """Test that search is case insensitive"""
+        # Search for lowercase
+        response = self.client.post('/search/', {'q': 'test'})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'Suchresultate für test')
+        
+        # Search for uppercase
+        response = self.client.post('/search/', {'q': 'TEST'})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'Suchresultate für TEST')
+        
+        # Search for mixed case
+        response = self.client.post('/search/', {'q': 'TeSt'})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'Suchresultate für TeSt')
+    
+    def test_search_in_kurztext(self):
+        """Test search in Kurztext content"""
+        response = self.client.post('/search/', {'q': 'Suchbegriff'})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'TEST-001')
+    
+    def test_search_in_langtext(self):
+        """Test search in Langtext content"""
+        response = self.client.post('/search/', {'q': 'anderem'})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'TEST-001')
+    
+    def test_search_in_titel(self):
+        """Test search in Vorgabe title"""
+        response = self.client.post('/search/', {'q': 'Titel'})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'TEST-001')
+    
+    def test_search_in_geltungsbereich(self):
+        """Test search in Geltungsbereich content"""
+        response = self.client.post('/search/', {'q': 'Geltungsbereich'})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'Standards mit')
+    
+    def test_search_no_results(self):
+        """Test search with no results"""
+        response = self.client.post('/search/', {'q': 'NichtVorhanden'})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'Keine Resultate für "NichtVorhanden"')
+    
+    def test_search_expired_vorgabe_not_included(self):
+        """Test that expired Vorgaben are not included in results"""
+        # Create expired Vorgabe
+        expired_vorgabe = Vorgabe.objects.create(
+            order=2,
+            nummer=2,
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Abgelaufene Vorgabe",
+            gueltigkeit_von=date.today() - timedelta(days=10),
+            gueltigkeit_bis=date.today() - timedelta(days=1)
+        )
+        
+        VorgabeKurztext.objects.create(
+            abschnitt=expired_vorgabe,
+            inhalt="Abgelaufener Inhalt mit Test"
+        )
+        
+        response = self.client.post('/search/', {'q': 'Test'})
+        self.assertEqual(response.status_code, 200)
+        
+        # Should only find the active Vorgabe, not the expired one
+        self.assertContains(response, 'Test Vorgabe Titel')
+        # The expired vorgabe should not appear in results
+        self.assertNotContains(response, 'Abgelaufene Vorgabe')
+    
+    def test_search_empty_term_validation(self):
+        """Test validation for empty search term"""
+        response = self.client.post('/search/', {'q': ''})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'Fehler:')
+        self.assertContains(response, 'Suchbegriff darf nicht leer sein')
+    
+    def test_search_no_term_validation(self):
+        """Test validation when no search term is provided"""
+        response = self.client.post('/search/', {})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'Fehler:')
+        self.assertContains(response, 'Suchbegriff darf nicht leer sein')
+    
+    def test_search_html_tags_stripped(self):
+        """Test that HTML tags are stripped from search input"""
+        response = self.client.post('/search/', {'q': '<script>alert("xss")</script>Test'})
+        self.assertEqual(response.status_code, 200)
+        # Should search for "alert('xss')Test" after HTML tag removal
+        self.assertContains(response, 'Suchresultate für alert(&quot;xss&quot;)Test')
+    
+    def test_search_invalid_characters_validation(self):
+        """Test validation for invalid characters"""
+        response = self.client.post('/search/', {'q': 'Test| DROP TABLE users'})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'Fehler:')
+        self.assertContains(response, 'Ungültige Zeichen im Suchbegriff')
+    
+    def test_search_too_long_validation(self):
+        """Test validation for overly long search terms"""
+        long_term = 'a' * 201  # 201 characters, exceeds limit of 200
+        response = self.client.post('/search/', {'q': long_term})
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'Fehler:')
+        self.assertContains(response, 'Suchbegriff ist zu lang')
+    
+    def test_search_max_length_allowed(self):
+        """Test that exactly 200 characters are allowed"""
+        max_term = 'a' * 200  # Exactly 200 characters
+        response = self.client.post('/search/', {'q': max_term})
+        self.assertEqual(response.status_code, 200)
+        # Should not show validation error
+        self.assertNotContains(response, 'Fehler:')
+    
+    def test_search_german_umlauts_allowed(self):
+        """Test that German umlauts are allowed in search"""
+        response = self.client.post('/search/', {'q': 'Test Müller äöü ÄÖÜ ß'})
+        self.assertEqual(response.status_code, 200)
+        # Should not show validation error
+        self.assertNotContains(response, 'Fehler:')
+    
+    def test_search_special_characters_allowed(self):
+        """Test that allowed special characters work"""
+        response = self.client.post('/search/', {'q': 'Test-Test, Test: Test; Test! Test? (Test) [Test] {Test} "Test" \'Test\''})
+        self.assertEqual(response.status_code, 200)
+        # Should not show validation error
+        self.assertNotContains(response, 'Fehler:')
+    
+    def test_search_input_preserved_on_error(self):
+        """Test that search input is preserved on validation errors"""
+        response = self.client.post('/search/', {'q': '<script>Test</script>'})
+        self.assertEqual(response.status_code, 200)
+        # The input should be preserved (escaped) in the form
+        # Since HTML tags are stripped, we expect "Test" to be searched
+        self.assertContains(response, 'Suchresultate für Test')
+    
+    def test_search_xss_prevention_in_results(self):
+        """Test that search terms are escaped in results to prevent XSS"""
+        # Create content with potential XSS
+        self.kurztext.inhalt = "Content with <script>alert('xss')</script> term"
+        self.kurztext.save()
+        
+        response = self.client.post('/search/', {'q': 'term'})
+        self.assertEqual(response.status_code, 200)
+        # The script tag should be escaped in the output
+        # Note: This depends on how the template renders the content
+        self.assertContains(response, 'Suchresultate für term')
+    
+    @patch('pages.views.pprint.pp')
+    def test_search_result_logging(self, mock_pprint):
+        """Test that search results are logged for debugging"""
+        response = self.client.post('/search/', {'q': 'Test'})
+        self.assertEqual(response.status_code, 200)
+        # Verify that pprint.pp was called with the result
+        mock_pprint.assert_called_once()
+    
+    def test_search_multiple_documents(self):
+        """Test search across multiple documents"""
+        # Create second document
+        dokument2 = Dokument.objects.create(
+            nummer="TEST-002",
+            dokumententyp=self.dokumententyp,
+            name="Zweites Test Dokument",
+            gueltigkeit_von=date.today(),
+            aktiv=True
+        )
+        
+        vorgabe2 = Vorgabe.objects.create(
+            order=1,
+            nummer=1,
+            dokument=dokument2,
+            thema=self.thema,
+            titel="Zweite Test Vorgabe",
+            gueltigkeit_von=date.today()
+        )
+        
+        VorgabeKurztext.objects.create(
+            abschnitt=vorgabe2,
+            inhalt="Zweiter Test Inhalt"
+        )
+        
+        response = self.client.post('/search/', {'q': 'Test'})
+        self.assertEqual(response.status_code, 200)
+        # Should find results from both documents
+        self.assertContains(response, 'TEST-001')
+        self.assertContains(response, 'TEST-002')
+
+
+class SearchValidationTest(TestCase):
+    """Test the validate_search_input function directly"""
+    
+    def test_validate_search_input_valid(self):
+        """Test valid search input"""
+        from pages.views import validate_search_input
+        
+        result = validate_search_input("Test Suchbegriff")
+        self.assertEqual(result, "Test Suchbegriff")
+    
+    def test_validate_search_input_empty(self):
+        """Test empty search input"""
+        from pages.views import validate_search_input
+        
+        with self.assertRaises(ValidationError) as context:
+            validate_search_input("")
+        
+        self.assertIn("Suchbegriff darf nicht leer sein", str(context.exception))
+    
+    def test_validate_search_input_html_stripped(self):
+        """Test that HTML tags are stripped"""
+        from pages.views import validate_search_input
+        
+        result = validate_search_input("<script>alert('xss')</script>Test")
+        self.assertEqual(result, "alert('xss')Test")
+    
+    def test_validate_search_input_invalid_chars(self):
+        """Test validation of invalid characters"""
+        from pages.views import validate_search_input
+        
+        with self.assertRaises(ValidationError) as context:
+            validate_search_input("Test| DROP TABLE users")
+        
+        self.assertIn("Ungültige Zeichen im Suchbegriff", str(context.exception))
+    
+    def test_validate_search_input_too_long(self):
+        """Test length validation"""
+        from pages.views import validate_search_input
+        
+        with self.assertRaises(ValidationError) as context:
+            validate_search_input("a" * 201)
+        
+        self.assertIn("Suchbegriff ist zu lang", str(context.exception))
+    
+    def test_validate_search_input_whitespace_stripped(self):
+        """Test that whitespace is stripped"""
+        from pages.views import validate_search_input
+        
+        result = validate_search_input("  Test Suchbegriff  ")
+        self.assertEqual(result, "Test Suchbegriff")

pages/views.py

@@ -1,6 +1,9 @@
 from django.shortcuts import render
+from django.core.exceptions import ValidationError
+from django.utils.html import escape
+import re
 from abschnitte.utils import render_textabschnitte
-from dokumente.models import Dokument, VorgabeLangtext, VorgabeKurztext, Geltungsbereich
+from dokumente.models import Dokument, VorgabeLangtext, VorgabeKurztext, Geltungsbereich, Vorgabe
 from itertools import groupby
 import datetime
 import pprint
@@ -9,23 +12,60 @@ def startseite(request):
     standards=list(Dokument.objects.filter(aktiv=True))
     return render(request, 'startseite.html', {"dokumente":standards,})
 
+def validate_search_input(search_term):
+    """
+    Validate search input to prevent SQL injection and XSS
+    """
+    if not search_term:
+        raise ValidationError("Suchbegriff darf nicht leer sein")
+    
+    # Remove any HTML tags to prevent XSS
+    search_term = re.sub(r'<[^>]*>', '', search_term)
+    
+    # Allow only alphanumeric characters, spaces, and basic punctuation
+    # This prevents SQL injection and other malicious input while allowing useful characters
+    if not re.match(r'^[a-zA-Z0-9äöüÄÖÜß\s\-\.\,\:\;\!\?\(\)\[\]\{\}\"\']+$', search_term):
+        raise ValidationError("Ungültige Zeichen im Suchbegriff")
+    
+    # Limit length to prevent DoS attacks
+    if len(search_term) > 200:
+        raise ValidationError("Suchbegriff ist zu lang")
+    
+    return search_term.strip()
+
 def search(request):
     if request.method == "GET":
         return render(request, 'search.html')
     elif request.method == "POST":
-        suchbegriff=request.POST.get("q")
+        raw_search_term = request.POST.get("q", "")
+        
+        try:
+            suchbegriff = validate_search_input(raw_search_term)
+        except ValidationError as e:
+            return render(request, 'search.html', {
+                'error_message': str(e),
+                'search_term': escape(raw_search_term)
+            })
+        
+        # Escape the search term for display in templates
+        safe_search_term = escape(suchbegriff)
         result= {"all": {}}
-        qs = VorgabeKurztext.objects.filter(inhalt__contains=suchbegriff).exclude(abschnitt__gueltigkeit_bis__lt=datetime.date.today())
+        qs = VorgabeKurztext.objects.filter(inhalt__icontains=suchbegriff).exclude(abschnitt__gueltigkeit_bis__lt=datetime.date.today())
         result["kurztext"] = {k: [o.abschnitt for o in g] for k, g in groupby(qs, key=lambda o: o.abschnitt.dokument)}
-        qs = VorgabeLangtext.objects.filter(inhalt__contains=suchbegriff).exclude(abschnitt__gueltigkeit_bis__lt=datetime.date.today())
+        qs = VorgabeLangtext.objects.filter(inhalt__icontains=suchbegriff).exclude(abschnitt__gueltigkeit_bis__lt=datetime.date.today())
         result['langtext']=  {k: [o.abschnitt for o in g] for k, g in groupby(qs, key=lambda o: o.abschnitt.dokument)}
+        qs = Vorgabe.objects.filter(titel__icontains=suchbegriff).exclude(gueltigkeit_bis__lt=datetime.date.today())
+        result['titel']= {k: list(g) for k, g in groupby(qs, key=lambda o: o.dokument)}
         for r in result.keys():
             for s in result[r].keys():
-                result["all"][s] = set(result[r][s])
+                if r == 'titel':
+                    result["all"][s] = set(result["all"].get(s, set()) | set(result[r][s]))
+                else:
+                    result["all"][s] = set(result["all"].get(s, set()) | set(result[r][s]))
         result["geltungsbereich"]={}
-        geltungsbereich=set(list([x.geltungsbereich for x in Geltungsbereich.objects.filter(inhalt__contains=suchbegriff)]))
+        geltungsbereich=set(list([x.geltungsbereich for x in Geltungsbereich.objects.filter(inhalt__icontains=suchbegriff)]))
         for s in geltungsbereich:
             result["geltungsbereich"][s]=render_textabschnitte(s.geltungsbereich_set.order_by("order"))
         pprint.pp (result)
-        return render(request,"results.html",{"suchbegriff":suchbegriff,"resultat":result})
+        return render(request,"results.html",{"suchbegriff":safe_search_term,"resultat":result})
 

test_sanity_check.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python
+"""
+Simple script to test Vorgaben sanity checking
+"""
+import os
+import sys
+import django
+
+# Setup Django
+os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'VorgabenUI.settings')
+django.setup()
+
+from dokumente.utils import check_vorgabe_conflicts, format_conflict_report
+
+
+def main():
+    print("Running Vorgaben sanity check...")
+    print("=" * 50)
+    
+    # Check for conflicts
+    conflicts = check_vorgabe_conflicts()
+    
+    # Generate and display report
+    report = format_conflict_report(conflicts, verbose=True)
+    print(report)
+    
+    print("=" * 50)
+    
+    if conflicts:
+        print(f"\n⚠️  Found {len(conflicts)} conflicts that need attention!")
+        sys.exit(1)
+    else:
+        print("✅ All Vorgaben are valid!")
+        sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()