Roundup Tracker - Issues

Message2904

Author mephinet
Recipients
Date 2007-10-18.15:45:21
Message-id
In-reply-to
If a template realizes the input of a link field not using an drop-down box, but with a text input field instead, it becomes possible to enter invalid keys.
In that case, instead of an error message, an IndexError is raised.

To reproduce, open e.g. the issue.item.html of the demo or the classic tracker, and replace 
context/assignedto/menu
with
context/assignedto/field

Now it is possible to enter invalid user names into the assigned-to field.
If you do so, instead of the error message, an IndexError is raised:

<type 'exceptions.IndexError'>: no such user johndoe

   1. While evaluating the standard:'context/assignedto/field' expression on line 77

[...]

  File "roundup/cgi/templating.py", line 1815, in field
    value = linkcl.get(self._value, k)
  File "/roundup/backends/back_anydbm.py", line 939, in get
    d = self.db.getnode(self.classname, nodeid)
  File "roundup/backends/back_anydbm.py", line 335, in getnode
    raise IndexError, "no such %s %s"%(classname, nodeid)
IndexError: no such user johndoe


The attached patch fixes the problem by reusing the logic already in place via the `lookupKeys` and `lookupIds` functions.

I was unable to come up with a unittest that reproduces the behavior, since the test/test_templating.py seems to be dysfunctional, but if you give me a hint where to start, I'll definitely give it another try...
History
Date User Action Args
2009-02-03 14:23:15adminlinkissue1815895 messages
2009-02-03 14:23:15admincreate