[GNUnet-SVN] [taler-merchant-frontends] branch master updated: fix unchecked /generate-contract arguments

[gnunet]

This is an automated email from the git hooks/post-receive script.

marcello pushed a commit to branch master
in repository merchant-frontends.

The following commit(s) were added to refs/heads/master by this push:
     new 84800fd  fix unchecked /generate-contract arguments
84800fd is described below

commit 84800fdf8b04d493aa02647f9913731615913eef
Author: Marcello Stanisci <address@hidden>
AuthorDate: Fri Jul 28 12:56:27 2017 +0200

    fix unchecked /generate-contract arguments
---
 talerfrontends/donations/donations.py | 9 ++++++---
 talerfrontends/helpers.py             | 6 +++++-
 talerfrontends/tests.py               | 1 -
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/talerfrontends/donations/donations.py 
b/talerfrontends/donations/donations.py
index 2b52c84..6fb15d9 100644
--- a/talerfrontends/donations/donations.py
+++ b/talerfrontends/donations/donations.py
@@ -28,7 +28,7 @@ import jinja2
 from talerfrontends.talerconfig import TalerConfig
 from talerfrontends.helpers import (make_url,
 expect_parameter, amount_from_float, amount_to_float,
-join_urlparts, get_query_string)
+join_urlparts, get_query_string, MissingParameterException)
 
 logger = logging.getLogger(__name__)
 
@@ -85,8 +85,11 @@ def checkout():
 
 @app.route("/generate-contract", methods=["GET"])
 def generate_contract():
-    donation_receiver = expect_parameter("donation_receiver")
-    donation_amount = expect_parameter("donation_amount")
+    try:
+        donation_receiver = expect_parameter("donation_receiver")
+        donation_amount = expect_parameter("donation_amount")
+    except MissingParameterException as e:
+        return flask.jsonify(dict(error="Missing parameter '%s'" % e)), 400
     amount = amount_from_float(float(donation_amount))
     order_id = "donation-%s-%X-%s" % \
                (donation_receiver,
diff --git a/talerfrontends/helpers.py b/talerfrontends/helpers.py
index 5b717c7..c19890d 100644
--- a/talerfrontends/helpers.py
+++ b/talerfrontends/helpers.py
@@ -37,6 +37,10 @@ FRACTION_BASE = 1e8
 if not NDIGITS:
     NDIGITS = 2
 
+class MissingParameterException(Exception):
+    def __init__(self, param):
+        self.param = param
+
 def amount_to_float(amount):
     return amount['value'] + (float(amount['fraction']) / float(FRACTION_BASE))
 
@@ -82,7 +86,7 @@ def expect_parameter(name, alt=None):
     value = request.args.get(name, None)
     if value is None and alt is None:
         logger.error("Missing parameter '%s'." % name)
-        return flask.jsonify(error="Missing parameter '%s'." % name), 400
+        raise MissingParameterException(name)
     return value if value else alt
 
 
diff --git a/talerfrontends/tests.py b/talerfrontends/tests.py
index 3d28995..7bdac73 100755
--- a/talerfrontends/tests.py
+++ b/talerfrontends/tests.py
@@ -27,7 +27,6 @@ class DonationsTestCase(unittest.TestCase):
         response = self.app.get(qs)
         assert 200 == response.status_code
         response = self.app.get(bad_qs)
-        # FIXME: might NOT be 400 here
         assert 400 == response.status_code
 
 class BlogTestCase(unittest.TestCase):

-- 
To stop receiving notification emails like this one, please contact
address@hidden