From 80c057d91d98f1f7a05e9fc9b201dc2fa8d2638f Mon Sep 17 00:00:00 2001
From: Steve Howell <showell@zulip.com>
Date: Thu, 25 Jun 2020 15:37:45 +0000
Subject: [PATCH] REQ: Use check_dict_only in update_user_backend.

Update the REQ check for profile_data in
update_user_backend by tweaking `check_profile_data`
to use `check_dict_only`.

Here is the relevant URL:

    path('users/<int:user_id>', rest_dispatch,
         {'GET': 'zerver.views.users.get_members_backend',

It would be nice to unify the validator
for these two views, but they are different:

    update_user_backend
    update_user_custom_profile_data

It's not completely clear to me why update_user_backend
seems to support a superset of the functionality
of `update_user_custom_profile_data`, but it has
this code to allow you to remove custom profile fields:

    clean_profile_data = []
    for entry in profile_data:
        assert isinstance(entry["id"], int)
        if entry["value"] is None or not entry["value"]:
            field_id = entry["id"]
            check_remove_custom_profile_field_value(target, field_id)
        else:
            clean_profile_data.append({
                "id": entry["id"],
                "value": entry["value"],
            })

Whereas the other view is much simpler:

def update_user_custom_profile_data(
    <snip>
) -> HttpResponse:

    validate_user_custom_profile_data(user_profile.realm.id, data)
    do_update_user_custom_profile_data_if_changed(user_profile, data)
    # We need to call this explicitly otherwise constraints are not check
    return json_success()
---
 zerver/views/users.py | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/zerver/views/users.py b/zerver/views/users.py
index c07fbefc14..d5d8d0b10a 100644
--- a/zerver/views/users.py
+++ b/zerver/views/users.py
@@ -56,6 +56,7 @@ from zerver.lib.utils import generate_api_key
 from zerver.lib.validator import (
     check_bool,
     check_dict,
+    check_dict_only,
     check_int,
     check_int_in,
     check_list,
@@ -124,12 +125,12 @@ def reactivate_user_backend(request: HttpRequest, user_profile: UserProfile,
     return json_success()
 
 check_profile_data: Validator[List[Dict[str, Optional[Union[int, str, List[int]]]]]] = check_list(
-    check_dict(
-        [('id', check_int)],
-        value_validator=check_none_or(check_union([
-            check_int, check_string, check_list(check_int),
-        ])),
-    ),
+    check_dict_only([
+        ('id', check_int),
+        ('value', check_none_or(
+            check_union([check_int, check_string, check_list(check_int)]),
+        )),
+    ]),
 )
 
 @has_request_variables