home · contact · privacy
On /todo POSTs, improve handling of malformed fill_for fields. master
authorChristian Heller <c.heller@plomlompom.de>
Sun, 14 Jul 2024 20:21:43 +0000 (22:21 +0200)
committerChristian Heller <c.heller@plomlompom.de>
Sun, 14 Jul 2024 20:21:43 +0000 (22:21 +0200)
plomtask/http.py
tests/todos.py

index 0d58af30d6370477f8247300b49f6ad49eff23c4..fbe4856355e14ae6f9d6781c1d7270f5d6932541 100644 (file)
@@ -576,7 +576,7 @@ class TaskHandler(BaseHTTPRequestHandler):
             day_comment = self._form_data.get_str('day_comment')
             make_type = self._form_data.get_str('make_type')
         except NotFoundException as e:
-            raise BadFormatException(e)
+            raise BadFormatException from e
         old_todos = self._form_data.get_all_int('todo_id')
         new_todos = self._form_data.get_all_int('new_todo')
         comments = self._form_data.get_all_str('comment')
@@ -613,7 +613,7 @@ class TaskHandler(BaseHTTPRequestHandler):
         """Update Todo and its children."""
         # pylint: disable=too-many-locals
         # pylint: disable=too-many-branches
-        # pylint: disable=too-many-branches
+        # pylint: disable=too-many-statements
         adopted_child_ids = self._form_data.get_all_int('adopt')
         processes_to_make_full = self._form_data.get_all_int('make_full')
         processes_to_make_empty = self._form_data.get_all_int('make_empty')
@@ -631,10 +631,19 @@ class TaskHandler(BaseHTTPRequestHandler):
         calendarize = len(self._form_data.get_all_str('calendarize')) > 0
         comment = self._form_data.get_str('comment', ignore_strict=True)
         for v in fill_fors.values():
+            target_id: int
+            for prefix in ['make_empty_', 'make_full_']:
+                if v.startswith(prefix):
+                    try:
+                        target_id = int(v[len(prefix):])
+                    except ValueError as e:
+                        msg = 'bad fill_for target: {v}'
+                        raise BadFormatException(msg) from e
+                    continue
             if v.startswith('make_empty_'):
-                processes_to_make_empty += [int(v[11:])]
+                processes_to_make_empty += [target_id]
             elif v.startswith('make_full_'):
-                processes_to_make_full += [int(v[10:])]
+                processes_to_make_full += [target_id]
             elif v != 'ignore':
                 adopted_child_ids += [int(v)]
         to_remove = []
index c5c29d49bc875921593ddeb5cf2053a49bb598a6..66c4ff3af14d6ac12efd835c17677976ed1df8dc 100644 (file)
@@ -253,6 +253,10 @@ class TestsWithServer(TestCaseWithServer):
         for name in ['adopt', 'effort', 'make_full', 'make_empty',
                      'conditions', 'disables', 'blockers', 'enables']:
             self.check_post({name: 'x'}, '/todo?id=1', 400, '/todo')
+        for prefix in ['make_empty_', 'make_full_']:
+            for suffix in ['', 'x', '1.1']:
+                self.check_post({'fill_for_1': f'{prefix}{suffix}'},
+                                '/todo?id=1', 400, '/todo')
         # test we cannot POST adoption of self or non-existing Todo
         self.check_post({'adopt': 1}, '/todo?id=1', 400)
         self.check_post({'adopt': 2}, '/todo?id=1', 404)