concrete-datastore icon indicating copy to clipboard operation
concrete-datastore copied to clipboard

Date filters on creation and modification date fields do not check if the given value is a valid date

Open KhaledBousrih opened this issue 3 years ago • 0 comments

When using concrete date filters (comparaison and range) on the fields creation_date and modification_date, there is no checks on the the format of the given value.

Concrete uses the method concrete_datastore.api.v1.datetime.ensure_pendulum attempts to convert the given value to a pendulum instance without checking the format of this value, so if the value is an invalid date, the server raises a 500 Internal Error.

Example:

from concrete_datastore.api.v1.datetime import ensure_pendulum

ensure_pendulum('INVALID_FORMAT')  # ParserError: Unable to parse string [INVALID_FORMAT]

For the datamodel fields, this checks are performed in the views.py by the method check_date_format.

This method is applied only on the fields of self.fields which does not contain the custom Concrete Datastore fields such as creation_date and modification_date.

KhaledBousrih avatar Feb 22 '22 09:02 KhaledBousrih