chrono/api/views.py

@@ -2150,7 +2150,10 @@ class MultipleAgendasEvents(APIView):
         slots = serializer.validated_data['slots']
         events_by_agenda = collections.defaultdict(list)
         for slot in slots:
-            agenda, event = slot.split('@')
+            try:
+                agenda, event = slot.split('@')
+            except ValueError:
+                raise APIErrorBadRequest(N_('invalid slugs: %s'), slot)
             events_by_agenda[agenda].append(event)
 
         agendas = get_objects_from_slugs(events_by_agenda.keys(), qs=Agenda.objects.filter(kind='events'))

tests/api/test_event.py

@@ -907,6 +907,22 @@ def test_events(app, user):
     assert resp.json['err'] == 1
     assert resp.json['err_desc'] == 'invalid slugs: foo@recurring-event-slug'
 
+    # bad event format
+    resp = app.get(
+        '/api/agendas/events/',
+        params={'slots': ['bar']},
+        status=400,
+    )
+    assert resp.json['err'] == 1
+    assert resp.json['err_desc'] == 'invalid slugs: bar'
+    resp = app.get(
+        '/api/agendas/events/',
+        params={'slots': ['bar@bar@bar']},
+        status=400,
+    )
+    assert resp.json['err'] == 1
+    assert resp.json['err_desc'] == 'invalid slugs: bar@bar@bar'
+
     # ok
     resp = app.get(
         '/api/agendas/events/',