diff --git a/chrono/api/views.py b/chrono/api/views.py index 3dc5a88d..1c9ef9d8 100644 --- a/chrono/api/views.py +++ b/chrono/api/views.py @@ -2150,7 +2150,10 @@ class MultipleAgendasEvents(APIView): slots = serializer.validated_data['slots'] events_by_agenda = collections.defaultdict(list) for slot in slots: - agenda, event = slot.split('@') + try: + agenda, event = slot.split('@') + except ValueError: + raise APIErrorBadRequest(N_('invalid slugs: %s'), slot) events_by_agenda[agenda].append(event) agendas = get_objects_from_slugs(events_by_agenda.keys(), qs=Agenda.objects.filter(kind='events')) diff --git a/tests/api/test_event.py b/tests/api/test_event.py index e97d3d98..34a70d34 100644 --- a/tests/api/test_event.py +++ b/tests/api/test_event.py @@ -907,6 +907,22 @@ def test_events(app, user): assert resp.json['err'] == 1 assert resp.json['err_desc'] == 'invalid slugs: foo@recurring-event-slug' + # bad event format + resp = app.get( + '/api/agendas/events/', + params={'slots': ['bar']}, + status=400, + ) + assert resp.json['err'] == 1 + assert resp.json['err_desc'] == 'invalid slugs: bar' + resp = app.get( + '/api/agendas/events/', + params={'slots': ['bar@bar@bar']}, + status=400, + ) + assert resp.json['err'] == 1 + assert resp.json['err_desc'] == 'invalid slugs: bar@bar@bar' + # ok resp = app.get( '/api/agendas/events/',