Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Catch updating alert profile with non int id #2756

Merged
merged 3 commits into from
Nov 23, 2023
Merged

Catch updating alert profile with non int id #2756

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ad1a5f0
Catch updating profile with non int id
johannaengland Nov 22, 2023
2ad2168
Add tests for updating alert profiles
johannaengland Nov 22, 2023
a605489
fixup! Add tests for updating alert profiles
johannaengland Nov 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion python/nav/web/alertprofiles/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -273,7 +273,7 @@ def profile_save(request):
if request.POST.get('id'):
try:
profile = AlertProfile.objects.get(pk=request.POST.get('id'))
except AlertProfile.DoesNotExist:
except (ValueError, AlertProfile.DoesNotExist):
return alertprofiles_response_not_found(
request, 'Requested profile does not exist'
)
Expand Down
43 changes: 43 additions & 0 deletions tests/integration/web/alertprofiles_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,49 @@ def test_alertprofiles_save_profile_with_time_period_template(
valid_during=TimePeriod.WEEKENDS,
).exists()

def test_alertprofiles_save_profile_with_str_id_should_fail(self, db, client):
url = reverse('alertprofiles-profile-save')
profile_name = 'Catch 22'

response = client.post(
url,
follow=True,
data={
'id': "-9337'))) ORDER BY 1-- SVmx",
'name': profile_name,
'daily_dispatch_time': '08:00',
'weekly_dispatch_time': '08:00',
'weekly_dispatch_day': AlertProfile.MONDAY,
},
)

assert response.status_code == 404
assert 'Requested profile does not exist' in smart_str(response.content)
assert not AlertProfile.objects.filter(name=profile_name).exists()

def test_alertprofiles_save_profile_with_non_existent_id_should_fail(
self, db, client
):
url = reverse('alertprofiles-profile-save')
profile_name = 'Catch 22'
last_alert_profile_id = getattr(AlertProfile.objects.last(), "pk", 0)

response = client.post(
url,
follow=True,
data={
'id': last_alert_profile_id + 1,
'name': profile_name,
'daily_dispatch_time': '08:00',
'weekly_dispatch_time': '08:00',
'weekly_dispatch_day': AlertProfile.MONDAY,
},
)

assert response.status_code == 404
assert 'Requested profile does not exist' in smart_str(response.content)
assert not AlertProfile.objects.filter(name=profile_name).exists()

def test_alertprofiles_confirm_remove_profile(self, db, client, dummy_profile):
url = reverse('alertprofiles-profile-remove')
response = client.post(
Expand Down
Loading