CGM_Public/pretix_original
2
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-05-03 14:54:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enforce uniqueness of order codes and ticket secrets (#3988)

Browse Source 
* Enforce uniqueness of order codes and ticket secrets

* Fix test cases which created orders with identical codes

---------

Co-authored-by: Mira Weller <weller@rami.io>
This commit is contained in:
Raphael Michel
2024-04-02 11:07:40 +02:00
committed by GitHub
parent 43e8875c1e
commit cda8144ff0
10 changed files with 230 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/tests/api/test_order_create.py
View File

@@ -279,6 +279,28 @@ def test_order_create(token_client, organizer, event, item, quota, question):
assert o.transactions.count() == 2
@pytest.mark.django_db
def test_order_create_duplicate_code(token_client, organizer, event, item, quota, question):
res = copy.deepcopy(ORDER_CREATE_PAYLOAD)
res['code'] = 'ABC12'
res['positions'][0]['item'] = item.pk
res['positions'][0]['answers'][0]['question'] = question.pk
resp = token_client.post(
'/api/v1/organizers/{}/events/{}/orders/'.format(
organizer.slug, event.slug
), format='json', data=res
)
assert resp.status_code == 201
assert resp.data['code'] == 'ABC12'
resp = token_client.post(
'/api/v1/organizers/{}/events/{}/orders/'.format(
organizer.slug, event.slug
), format='json', data=res
)
assert resp.status_code == 400
assert resp.data == {"code": ["This order code is already in use."]}
@pytest.mark.django_db
def test_order_create_max_size(token_client, organizer, event, item, quota, question):
quota.size = settings.PRETIX_MAX_ORDER_SIZE * 2

2
src/tests/base/test_invoices.py
View File

@@ -447,7 +447,7 @@ def test_invoice_numbers(env):
order2.fees.create(fee_type=OrderFee.FEE_TYPE_PAYMENT, value=Decimal('0.25'), tax_rate=Decimal('0.00'),
tax_value=Decimal('0.00'))
testorder = Order.objects.create(
code='BAR', event=event, email='dummy2@dummy.test',
code='TESTBAR', event=event, email='dummy2@dummy.test',
status=Order.STATUS_PENDING,
datetime=now(), expires=now() + timedelta(days=10),
total=0, testmode=True,

4
src/tests/base/test_models.py
View File

@@ -2581,7 +2581,7 @@ class CheckinListTestCase(TestCase):
)
self.cl_tickets.limit_products.add(self.item1)
o = Order.objects.create(
code='FOO', event=self.event, email='dummy@dummy.test',
code='FOO1', event=self.event, email='dummy@dummy.test',
status=Order.STATUS_PAID,
datetime=now(), expires=now() + timedelta(days=10),
total=Decimal("30"), locale='en'
@@ -2608,7 +2608,7 @@ class CheckinListTestCase(TestCase):
op3.checkins.create(list=self.cl_both)
o = Order.objects.create(
code='FOO', event=self.event, email='dummy@dummy.test',
code='FOO2', event=self.event, email='dummy@dummy.test',
status=Order.STATUS_PENDING,
datetime=now(), expires=now() + timedelta(days=10),
total=Decimal("30"), locale='en'

114
src/tests/concurrency_tests/test_api_order_creation_code.py Normal file
View File

@@ -0,0 +1,114 @@
#
# This file is part of pretix (Community Edition).
#
# Copyright (C) 2014-2020 Raphael Michel and contributors
# Copyright (C) 2020-2021 rami.io GmbH and contributors
#
# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
# Public License as published by the Free Software Foundation in version 3 of the License.
#
# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
# this file, see <https://pretix.eu/about/en/license>.
#
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
# details.
#
# You should have received a copy of the GNU Affero General Public License along with this program. If not, see
# <https://www.gnu.org/licenses/>.
#
import asyncio
import pytest
from asgiref.sync import sync_to_async
from django_scopes import scopes_disabled
from pretix.base.models import Order, OrderPosition
async def post_code(session, url, data, **kwargs):
async with session.post(url, json=data, **kwargs) as response:
return response.status
@pytest.mark.asyncio
async def test_quota_race_condition_same_order_code(live_server, session, device, event, item, quota):
url = f"/api/v1/organizers/{event.organizer.slug}/events/{event.slug}/orders/?_debug_flag=sleep-after-quota-check"
payload = {
"code": "ABC12",
"email": "dummy@dummy.test",
"phone": "+49622112345",
"locale": "en",
"sales_channel": "web",
"valid_if_pending": True,
"fees": [],
"payment_provider": "banktransfer",
"positions": [
{
"positionid": 1,
"item": item.pk,
"variation": None,
"price": "23.00",
"attendee_name_parts": {"full_name": "Peter"},
"attendee_email": None,
"addon_to": None,
"company": "FOOCORP",
"answers": [],
"subevent": None
}
],
}
r1, r2 = await asyncio.gather(
post_code(session, f"{live_server}{url}", data=payload,
headers={"Authorization": f"Device {device.api_token}"}),
post_code(session, f"{live_server}{url}", data=payload,
headers={"Authorization": f"Device {device.api_token}"}),
)
with scopes_disabled():
assert await sync_to_async(Order.objects.filter(code="ABC12").count)() == 1
assert [r1, r2].count(201) == 1
assert [r1, r2].count(400) == 1
@pytest.mark.asyncio
async def test_quota_race_condition_same_ticket_secret(live_server, session, device, event, item, quota):
url = f"/api/v1/organizers/{event.organizer.slug}/events/{event.slug}/orders/?_debug_flag=sleep-after-quota-check"
payload = {
"email": "dummy@dummy.test",
"phone": "+49622112345",
"locale": "en",
"sales_channel": "web",
"valid_if_pending": True,
"fees": [],
"payment_provider": "banktransfer",
"positions": [
{
"positionid": 1,
"item": item.pk,
"variation": None,
"price": "23.00",
"attendee_name_parts": {"full_name": "Peter"},
"attendee_email": None,
"addon_to": None,
"company": "FOOCORP",
"answers": [],
"secret": "foobarbaz",
"subevent": None
}
],
}
# Other one is just assigned differently
r1, r2 = await asyncio.gather(
post_code(session, f"{live_server}{url}", data=payload,
headers={"Authorization": f"Device {device.api_token}"}),
post_code(session, f"{live_server}{url}", data=payload,
headers={"Authorization": f"Device {device.api_token}"}),
)
with scopes_disabled():
assert await sync_to_async(OrderPosition.objects.filter(secret="foobarbaz").count)() == 1
assert await sync_to_async(OrderPosition.objects.exclude(secret="foobarbaz").count)() == 1
assert [r1, r2].count(201) == 2

2
src/tests/control/test_checkins.py
View File

@@ -105,7 +105,7 @@ def test_dashboard(dashboard_env):
def test_dashboard_pending_not_count(dashboard_env):
c = checkin_widget(dashboard_env[0])
order_pending = Order.objects.create(
code='FOO', event=dashboard_env[0], email='dummy@dummy.test',
code='BAR', event=dashboard_env[0], email='dummy@dummy.test',
status=Order.STATUS_PENDING,
datetime=now(), expires=now() + timedelta(days=10),
total=23, locale='en'

2
src/tests/plugins/banktransfer/test_refund_export.py
View File

@@ -71,7 +71,7 @@ def refund_huf(env):
date_from=now(), plugins='pretix.plugins.banktransfer,pretix.plugins.paypal'
)
order = Order.objects.create(
code='1Z3AS', event=event, email='admin@localhost',
code='HUFFY', event=event, email='admin@localhost',
status=Order.STATUS_PAID,
datetime=now(), expires=now() + timedelta(days=10),
total=42

4
src/tests/plugins/sendmail/test_rules.py
View File

@@ -283,13 +283,13 @@ def test_sendmail_rule_all_subevents(event_series, subevent1, subevent2, item):
o1 = Order.objects.create(event=item.event, status=Order.STATUS_PAID,
expires=now() + datetime.timedelta(hours=1),
total=13, code='DUMMY', email='dummy1@dummy.test',
total=13, code='DUMMY1', email='dummy1@dummy.test',
datetime=now(), locale='en')
o1.all_positions.create(item=item, price=13, subevent=subevent1)
o1.all_positions.create(item=item, price=13, subevent=subevent2)
o2 = Order.objects.create(event=item.event, status=Order.STATUS_PAID,
expires=now() + datetime.timedelta(hours=1),
total=13, code='DUMMY', email='dummy2@dummy.test',
total=13, code='DUMMY2', email='dummy2@dummy.test',
datetime=now(), locale='en')
o2.all_positions.create(item=item, price=23, subevent=subevent1)
o2.all_positions.create(item=item, price=23, subevent=subevent2)