From a2fd012106b806c6f091f033555d962c73549783 Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Sun, 16 Apr 2023 14:14:29 +0200 Subject: [PATCH] Add-on step: Catch ValueError on invalid input --- src/pretix/presale/checkoutflow.py | 10 ++++++++-- src/pretix/presale/views/order.py | 10 ++++++++-- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/src/pretix/presale/checkoutflow.py b/src/pretix/presale/checkoutflow.py index 11ab367f5..6202f0fc9 100644 --- a/src/pretix/presale/checkoutflow.py +++ b/src/pretix/presale/checkoutflow.py @@ -620,12 +620,18 @@ class AddOnsStep(CartMixin, AsyncAction, TemplateFlowStep): for i in category['items']: if i.has_variations: for v in i.available_variations: - val = int(self.request.POST.get(f'cp_{form["pos"].pk}_variation_{i.pk}_{v.pk}') or '0') + try: + val = int(self.request.POST.get(f'cp_{form["pos"].pk}_variation_{i.pk}_{v.pk}') or '0') + except ValueError: + raise ValidationError(_('Please enter numbers only.')) price = self.request.POST.get(f'cp_{form["pos"].pk}_variation_{i.pk}_{v.pk}_price') or '0' if val: selected[i, v] = val, price else: - val = int(self.request.POST.get(f'cp_{form["pos"].pk}_item_{i.pk}') or '0') + try: + val = int(self.request.POST.get(f'cp_{form["pos"].pk}_item_{i.pk}') or '0') + except ValueError: + raise ValidationError(_('Please enter numbers only.')) price = self.request.POST.get(f'cp_{form["pos"].pk}_item_{i.pk}_price') or '0' if val: selected[i, None] = val, price diff --git a/src/pretix/presale/views/order.py b/src/pretix/presale/views/order.py index 4612e4f3c..2890a7746 100644 --- a/src/pretix/presale/views/order.py +++ b/src/pretix/presale/views/order.py @@ -1370,12 +1370,18 @@ class OrderChangeMixin: for i in category['items']: if i.has_variations: for v in i.available_variations: - val = int(self.request.POST.get(f'cp_{form["pos"].pk}_variation_{i.pk}_{v.pk}') or '0') + try: + val = int(self.request.POST.get(f'cp_{form["pos"].pk}_variation_{i.pk}_{v.pk}') or '0') + except ValueError: + raise ValidationError(_('Please enter numbers only.')) price = self.request.POST.get(f'cp_{form["pos"].pk}_variation_{i.pk}_{v.pk}_price') or '0' if val: selected[i, v] = val, price else: - val = int(self.request.POST.get(f'cp_{form["pos"].pk}_item_{i.pk}') or '0') + try: + val = int(self.request.POST.get(f'cp_{form["pos"].pk}_item_{i.pk}') or '0') + except ValueError: + raise ValidationError(_('Please enter numbers only.')) price = self.request.POST.get(f'cp_{form["pos"].pk}_item_{i.pk}_price') or '0' if val: selected[i, None] = val, price