manager: fix page reorder with missing param (#63650)

combo/manager/views.py

@@ -25,7 +25,7 @@ from django.conf import settings
 from django.contrib import messages
 from django.core.exceptions import ObjectDoesNotExist, PermissionDenied
 from django.db import transaction
-from django.http import Http404, HttpResponse, HttpResponseRedirect, JsonResponse
+from django.http import Http404, HttpResponse, HttpResponseBadRequest, HttpResponseRedirect, JsonResponse
 from django.shortcuts import get_object_or_404, redirect, render
 from django.template import engines
 from django.urls import reverse, reverse_lazy
@@ -868,6 +868,10 @@ cell_order = PageCellOrder.as_view()
 
 @staff_required
 def page_order(request):
+    params = ['new-order', 'moved-page-id', 'moved-page-new-parent']
+    for param in params:
+        if param not in request.GET:
+            return HttpResponseBadRequest('missing %s parameter' % param)
     new_order = [int(x) for x in request.GET['new-order'].split(',')]
     moved_page = Page.objects.get(id=request.GET['moved-page-id'])
     if request.GET['moved-page-new-parent']:

tests/test_manager.py

@@ -771,6 +771,32 @@ def test_page_reorder(app, admin_user):
     ordered_ids = [x.id for x in Page.get_as_reordered_flat_hierarchy(Page.objects.all())]
     assert ordered_ids == [page1.id, page2.id, page3.id, page4.id]
 
+    # missing get params
+    app.get(
+        '/manage/pages/order',
+        params={
+            'moved-page-new-parent': 42,
+            'new-order': '42',
+        },
+        status=400,
+    )
+    app.get(
+        '/manage/pages/order',
+        params={
+            'moved-page-id': 42,
+            'new-order': '42',
+        },
+        status=400,
+    )
+    app.get(
+        '/manage/pages/order',
+        params={
+            'moved-page-id': 42,
+            'moved-page-new-parent': 42,
+        },
+        status=400,
+    )
+
     # missing page3 in order
     app.get(
         '/manage/pages/order',