From 8a741ed3d4b1908f0038ae899d5e68fb64566798 Mon Sep 17 00:00:00 2001 From: Kevin Mehall Date: Mon, 19 Aug 2013 15:05:23 -0400 Subject: [PATCH] Ensure that the pointer is valid before saving it. Trac #1716 Fix the tests to use real message IDs for the pointer. One helper didn't use the pointer ID it was passed at all, so the test didn't actually test what it was supposed to before. (imported from commit 457bcdb04a6c3873e224b68cd9d79c9a26612010) --- zerver/tests.py | 27 ++++++++++++++++++--------- zerver/views.py | 8 ++++++++ 2 files changed, 26 insertions(+), 9 deletions(-) diff --git a/zerver/tests.py b/zerver/tests.py index ffee0d23ba..f0bf543d09 100644 --- a/zerver/tests.py +++ b/zerver/tests.py @@ -665,9 +665,10 @@ class PointerTest(AuthedTestCase): """ self.login("hamlet@zulip.com") self.assertEqual(get_user_profile_by_email("hamlet@zulip.com").pointer, -1) - result = self.client.post("/json/update_pointer", {"pointer": 1}) + msg_id = self.send_message("othello@zulip.com", "Verona", Recipient.STREAM).id + result = self.client.post("/json/update_pointer", {"pointer": msg_id}) self.assert_json_success(result) - self.assertEqual(get_user_profile_by_email("hamlet@zulip.com").pointer, 1) + self.assertEqual(get_user_profile_by_email("hamlet@zulip.com").pointer, msg_id) def test_api_update_pointer(self): """ @@ -676,11 +677,12 @@ class PointerTest(AuthedTestCase): email = "hamlet@zulip.com" api_key = self.get_api_key(email) self.assertEqual(get_user_profile_by_email(email).pointer, -1) + msg_id = self.send_message("othello@zulip.com", "Verona", Recipient.STREAM).id result = self.client.post("/api/v1/update_pointer", {"email": email, "api-key": api_key, - "pointer": 1}) + "pointer": msg_id}) self.assert_json_success(result) - self.assertEqual(get_user_profile_by_email(email).pointer, 1) + self.assertEqual(get_user_profile_by_email(email).pointer, msg_id) def test_missing_pointer(self): """ @@ -1877,7 +1879,7 @@ class GetProfileTest(AuthedTestCase): def common_update_pointer(self, email, pointer): self.login(email) - result = self.client.post("/json/update_pointer", {"pointer": 1}) + result = self.client.post("/json/update_pointer", {"pointer": pointer}) self.assert_json_success(result) def common_get_profile(self, email): @@ -1910,15 +1912,22 @@ class GetProfileTest(AuthedTestCase): """ Ensure get_profile returns a proper pointer id after the pointer is updated """ + + id1 = self.send_message("othello@zulip.com", "Verona", Recipient.STREAM).id + id2 = self.send_message("othello@zulip.com", "Verona", Recipient.STREAM).id + json = self.common_get_profile("hamlet@zulip.com") - self.common_update_pointer("hamlet@zulip.com", 1) + self.common_update_pointer("hamlet@zulip.com", id2) json = self.common_get_profile("hamlet@zulip.com") - self.assertEqual(json["pointer"], 1) + self.assertEqual(json["pointer"], id2) - self.common_update_pointer("hamlet@zulip.com", 0) + self.common_update_pointer("hamlet@zulip.com", id1) json = self.common_get_profile("hamlet@zulip.com") - self.assertEqual(json["pointer"], 1) + self.assertEqual(json["pointer"], id2) # pointer does not move backwards + + result = self.client.post("/json/update_pointer", {"pointer": 99999999}) + self.assert_json_error(result, "Invalid message ID") class GetPublicStreamsTest(AuthedTestCase): diff --git a/zerver/views.py b/zerver/views.py index 0ad1bbf883..eaf246083c 100644 --- a/zerver/views.py +++ b/zerver/views.py @@ -716,6 +716,14 @@ def update_pointer_backend(request, user_profile, if pointer <= user_profile.pointer: return json_success() + try: + UserMessage.objects.get( + user_profile=user_profile, + message__id=pointer + ) + except UserMessage.DoesNotExist: + raise JsonableError("Invalid message ID") + prev_pointer = user_profile.pointer user_profile.pointer = pointer user_profile.save(update_fields=["pointer"])