Skip to content

Commit 4c1233c

Browse files
committed
Don't crash when passing in invalid values for filters
Previously we'd throw a 500 internal server error, and cause error logging to happen. This became evident when scripts trying to SQL-inject the site started hitting us.. Instead, just ignore any filters that pass non-integer values into integer fields completely.
1 parent ddf6581 commit 4c1233c

File tree

1 file changed

+21
-4
lines changed

1 file changed

+21
-4
lines changed

pgcommitfest/commitfest/views.py

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,12 @@ def commitfest(request, cfid):
106106
# Build a dynamic filter based on the filtering options entered
107107
q = Q()
108108
if request.GET.has_key('status') and request.GET['status'] != "-1":
109-
q = q & Q(patchoncommitfest__status=int(request.GET['status']))
109+
try:
110+
q = q & Q(patchoncommitfest__status=int(request.GET['status']))
111+
except ValueError:
112+
# int() failed -- so just ignore this filter
113+
pass
114+
110115
if request.GET.has_key('author') and request.GET['author'] != "-1":
111116
if request.GET['author'] == '-2':
112117
q = q & Q(authors=None)
@@ -116,7 +121,12 @@ def commitfest(request, cfid):
116121
return HttpResponseRedirect('%s?next=%s' % (settings.LOGIN_URL, request.path))
117122
q = q & Q(authors=request.user)
118123
else:
119-
q = q & Q(authors__id=int(request.GET['author']))
124+
try:
125+
q = q & Q(authors__id=int(request.GET['author']))
126+
except ValueError:
127+
# int() failed -- so just ignore this filter
128+
pass
129+
120130
if request.GET.has_key('reviewer') and request.GET['reviewer'] != "-1":
121131
if request.GET['reviewer'] == '-2':
122132
q = q & Q(reviewers=None)
@@ -126,7 +136,11 @@ def commitfest(request, cfid):
126136
return HttpResponseRedirect('%s?next=%s' % (settings.LOGIN_URL, request.path))
127137
q = q & Q(reviewers=request.user)
128138
else:
129-
q = q & Q(reviewers__id=int(request.GET['reviewer']))
139+
try:
140+
q = q & Q(reviewers__id=int(request.GET['reviewer']))
141+
except ValueError:
142+
# int() failed -- so just ignore this filter
143+
pass
130144

131145
if request.GET.has_key('text') and request.GET['text'] != '':
132146
q = q & Q(name__icontains=request.GET['text'])
@@ -136,7 +150,10 @@ def commitfest(request, cfid):
136150
# Figure out custom ordering
137151
ordering = ['-is_open', 'topic__topic', 'created',]
138152
if request.GET.has_key('sortkey') and request.GET['sortkey']!='':
139-
sortkey=int(request.GET['sortkey'])
153+
try:
154+
sortkey=int(request.GET['sortkey'])
155+
except ValueError:
156+
sortkey=0
140157

141158
if sortkey==1:
142159
ordering = ['-is_open', 'modified', 'created',]

0 commit comments

Comments
 (0)