Procházet zdrojové kódy

HUE-4123 [core] Verify id parameter values in GET requests

Jenny Kim před 9 roky
rodič
revize
ddb0adf

+ 3 - 1
apps/beeswax/src/beeswax/views.py

@@ -947,8 +947,10 @@ def _list_query_history(user, querydict, page_size, prefix=""):
 
   # Design id
   design_id = querydict.get(prefix + 'design_id')
-  if design_id:
+  if design_id and design_id.isdigit():
     db_queryset = db_queryset.filter(design__id=int(design_id))
+  else:
+    raise PopupException(_('list_query_history requires design_id parameter to be an integer: %s') % design_id)
 
   # Search
   search_filter = querydict.get(prefix + 'search')

+ 12 - 3
desktop/core/src/desktop/api.py

@@ -112,6 +112,7 @@ def massaged_tags_for_json(docs, user):
 
   return ts
 
+
 def massaged_tags(tag, tag_doc_mapping):
   return {
     'id': tag.id,
@@ -143,6 +144,7 @@ def massage_permissions(document):
       }
     }
 
+
 def massaged_documents_for_json(documents, user):
   """
   var DOCUMENTS_DEFAULTS = {
@@ -189,11 +191,18 @@ def massaged_documents_for_json(documents, user):
 
 @require_GET
 def get_document(request):
-  doc_id = request.GET['id']
-  doc = Document.objects.get(id=doc_id)
-  response = massage_doc_for_json(doc, request.user)
+  response = {'status': -1, 'message': ''}
+  doc_id = request.GET.get('id', '')
+
+  if doc_id.isdigit():
+    doc = Document.objects.get(id=doc_id)
+    response = massage_doc_for_json(doc, request.user)
+  else:
+    response['message'] = _('get_document requires an id integer parameter: %s') % doc_id
+
   return JsonResponse(response)
 
+
 def massage_doc_for_json(document, user, url=''):
   read_perms = document.list_permissions(perm='read')
   write_perms = document.list_permissions(perm='write')