janeway icon indicating copy to clipboard operation
janeway copied to clipboard

Account fields are not properly validated on import

Open joemull opened this issue 3 years ago • 2 comments

Describe the bug It is possible to pass any string to the email field when importing account data (e.g. with plugins/imports/articles/all). Other fields are likely not being validated either. @mauromsl figured out that this was due to the AccountQuerySet class definition:

class AccountQuerySet(models.query.QuerySet):
    def create(self, **kwargs):
        obj = self.model(**kwargs)
        obj.clean()
        self._for_write = True
        obj.save(force_insert=True, using=self.db)
        return obj

Rather than obj.clean() it should have obj.full_clean(). This change has ramifications elsewhere, so other changes are going to be needed.

Janeway version 1.4

To see evidence of this, look at how test_bad_data in plugins/imports/tests/test_utils.py passes.

joemull avatar Nov 12 '21 18:11 joemull