concrete-datastore
concrete-datastore copied to clipboard
Date filters on creation and modification date fields do not check if the given value is a valid date
When using concrete date filters (comparaison and range) on the fields creation_date and modification_date, there is no checks on the the format of the given value.
Concrete uses the method concrete_datastore.api.v1.datetime.ensure_pendulum attempts to convert the given value to a pendulum instance without checking the format of this value, so if the value is an invalid date, the server raises a 500 Internal Error.
Example:
from concrete_datastore.api.v1.datetime import ensure_pendulum
ensure_pendulum('INVALID_FORMAT') # ParserError: Unable to parse string [INVALID_FORMAT]
For the datamodel fields, this checks are performed in the views.py by the method check_date_format.
This method is applied only on the fields of self.fields which does not contain the custom Concrete Datastore fields such as creation_date and modification_date.