Fix crash in invalid timeseries URL (fixes openmeteo#493)

Shrhawk · May 23, 2023 · 669c622 · 669c622
1 parent 34916bb
commit 669c622
Showing 1 changed file with 11 additions and 3 deletions.
diff --git a/enhydris/api/views.py b/enhydris/api/views.py
@@ -167,6 +167,7 @@ class TimeseriesViewSet(ModelViewSet):
     CHART_MAX_INTERVALS = 200
     queryset = models.Timeseries.objects.all()
     serializer_class = serializers.TimeseriesSerializer
+    lookup_value_regex = '\d+'
 
     def get_permissions(self):
         if self.action in ("data", "bottom", "chart"):
@@ -237,7 +238,7 @@ def data(self, request, pk=None, *, station_id, timeseries_group_id=None):
 
     @action(detail=True, methods=["get"])
     def bottom(self, request, pk=None, *, station_id, timeseries_group_id=None):
-        ts = get_object_or_404(models.Timeseries, pk=pk)
+        ts = get_object_or_404(models.Timeseries, pk=int(pk))
         self.check_object_permissions(request, ts)
         response = HttpResponse(content_type="text/plain")
         timezone_param = request.GET.get("timezone", None)
@@ -246,7 +247,7 @@ def bottom(self, request, pk=None, *, station_id, timeseries_group_id=None):
 
     @action(detail=True, methods=["get"])
     def chart(self, request, pk=None, *, station_id, timeseries_group_id=None):
-        timeseries = get_object_or_404(models.Timeseries, pk=pk)
+        timeseries = get_object_or_404(models.Timeseries, pk=int(pk))
         self.check_object_permissions(request, timeseries)
         serializer = serializers.TimeseriesRecordChartSerializer(
             self._get_chart_data(request, timeseries), many=True
@@ -301,7 +302,14 @@ def _get_date_bounds(self, request, timeseries):
         return start_date, end_date
 
     def _get_data(self, request, pk, format=None):
-        timeseries = get_object_or_404(models.Timeseries, pk=int(pk))
+        try:
+            timeseries = get_object_or_404(models.Timeseries, pk=int(pk))
+        except ValueError as e:
+            return HttpResponse(
+                status=status.HTTP_400_BAD_REQUEST,
+                content=str(e),
+                content_type="text/plain",
+            )
         self.check_object_permissions(request, timeseries)
         start_date, end_date = self._get_date_bounds(request, timeseries)
         fmt_param = request.GET.get("fmt", "csv").lower()