opendev/storyboard
Code Issues Proposed changes

do not allow story id to change via payload

Browse Source 
There is already an explicit check to prevent changing a task through
a URL referring to the wrong
story. storyboard.tests.api.test_tasks.TestTasksNestedController.test_update_error
is failing with sqlite when the story id of a task is modified, but it
fails with the wrong error (404 instead of 400). Update the controller
to test the case explicitly and return 400.

Change-Id: Iabbc9cc733cc96fe77b721d28ee350a9beab7613
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
This commit is contained in:
Doug Hellmann 2018-01-30 21:04:04 +00:00
parent b65dad822b
commit ac2b2921d6
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
storyboard/api/v1/tasks.py
View File

@ -664,6 +664,12 @@ class TasksNestedController(rest.RestController):
if original_task.story_id != story_id:
abort(400, _("URL story_id and task.story_id do not match"))
if task.story_id and original_task.story_id != task.story_id:
abort(
400,
_("the story_id of a task cannot be changed through this API"),
)
task = task_is_valid_put(task, original_task)
updated_task = tasks_api.task_update(task_id, task.as_dict(