janeway
janeway copied to clipboard
Account fields are not properly validated on import
Describe the bug
It is possible to pass any string to the email field when importing account data (e.g. with plugins/imports/articles/all
). Other fields are likely not being validated either. @mauromsl figured out that this was due to the AccountQuerySet class definition:
class AccountQuerySet(models.query.QuerySet):
def create(self, **kwargs):
obj = self.model(**kwargs)
obj.clean()
self._for_write = True
obj.save(force_insert=True, using=self.db)
return obj
Rather than obj.clean()
it should have obj.full_clean()
. This change has ramifications elsewhere, so other changes are going to be needed.
Janeway version 1.4
To see evidence of this, look at how test_bad_data
in plugins/imports/tests/test_utils.py
passes.