data_transfer: check that import is a dictionnary

src/authentic2/data_transfer.py

@@ -246,6 +246,9 @@ def import_ou(ou_d):
 def import_site(json_d, import_context):
     result = ImportResult()
 
+    if not isinstance(json_d, dict):
+        raise DataImportError('Export file is invalid: not a dictionnary')
+
     for ou_d in json_d.get('ous', []):
         result.update_ous(*import_ou(ou_d))
 

tests/test_manager.py

@@ -667,6 +667,11 @@ def test_manager_site_import_error(app, db, superuser):
     with pytest.raises(Role.DoesNotExist):
         Role.objects.get(slug='basic')
 
+    form['site_json'] = Upload(
+        'site_export.json', json.dumps([]), 'application/octet-stream')
+    res = form.submit()
+    assert res.status_code == 200
+
 
 def test_manager_site_import_forbidden(app, simple_user):
     login(app, simple_user)