From 41380cd785168727f13532f628331f5c750a631c Mon Sep 17 00:00:00 2001 From: sohalt Date: Tue, 8 Oct 2019 14:47:08 +0200 Subject: [PATCH] Handle malformed requests for question reordering --- src/pretix/control/views/item.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/pretix/control/views/item.py b/src/pretix/control/views/item.py index 1b5971a7c1..8b54959915 100644 --- a/src/pretix/control/views/item.py +++ b/src/pretix/control/views/item.py @@ -1,4 +1,5 @@ import json +from json.decoder import JSONDecodeError from collections import OrderedDict from django.contrib import messages @@ -7,7 +8,7 @@ from django.core.files import File from django.db import transaction from django.db.models import Count, F, Prefetch, Q from django.forms.models import inlineformset_factory -from django.http import Http404, HttpResponse, HttpResponseRedirect +from django.http import Http404, HttpResponse, HttpResponseRedirect, HttpResponseBadRequest from django.shortcuts import redirect from django.urls import resolve, reverse from django.utils.functional import cached_property @@ -285,7 +286,11 @@ class QuestionList(PaginationMixin, ListView): @event_permission_required("can_change_items") def reorder_questions(request, organizer, event): - ids = json.loads(request.body.decode('utf-8'))['ids'] + try: + ids = json.loads(request.body.decode('utf-8'))['ids'] + except (JSONDecodeError, KeyError): + return HttpResponseBadRequest() + questions = request.event.questions if questions.count() != questions.filter(id__in=ids).count():