concrete-datastore
concrete-datastore copied to clipboard
Validate uid tokens for unsubscription views
For unsubscription views here: https://github.com/Netsach/concrete-datastore/blob/master/concrete_datastore/concrete/views.py#L50
A get_object_or_404 is done without checking the type of the token. If it's not an UUID, an error is raised and it should only return a 400.
Suggestions:
- Check in the urls directly that we have an UUID in the path
- Add an UUID validation before the get_object_or_404