Fix 500s due to bad form data

liberapay/main.py

@@ -4,6 +4,7 @@
 from six.moves.urllib.parse import quote as urlquote
 
 import aspen
+import aspen.http.mapping
 
 from liberapay import canonize, fill_accept_header, insert_constants, utils, wireup
 from liberapay.cron import Cron
@@ -125,8 +126,16 @@ def return_500_for_exception(website, exception):
 ]
 
 
-# Monkey patch aspen.Response
-# ===========================
+# Monkey patch aspen
+# ==================
+
+pop = aspen.http.mapping.Mapping.pop
+def _pop(self, name, default=aspen.http.mapping.NO_DEFAULT):
+    try:
+        return pop(self, name, default)
+    except KeyError:
+        raise aspen.Response(400, "Missing key: %s" % repr(name))
+aspen.http.mapping.Mapping.pop = _pop
 
 if hasattr(aspen.Response, 'redirect'):
     raise Warning('aspen.Response.redirect() already exists')

tests/py/test_sign_in.py

@@ -162,6 +162,9 @@ def test_email_login_bad_token(self):
     def sign_in(self, custom):
         data = dict(good_data)
         for k, v in custom.items():
+            if v is None:
+                del data['sign-in.'+k]
+                continue
             data['sign-in.'+k] = v
         return self.client.POST('/sign-in', data, raise_immediately=False)
 
@@ -207,5 +210,5 @@ def test_sign_in_bad_email(self):
         assert r.code == 400
 
     def test_sign_in_terms_not_checked(self):
-        r = self.sign_in(dict(terms=''))
+        r = self.sign_in(dict(terms=None))
         assert r.code == 400

www/%username/identity.spt

@@ -39,11 +39,17 @@ if request.method == 'POST':
         v = body.get(k)
         if v:
             setattr(account, k, v)
+        else:
+            error = _("You haven't filled all the required fields.")
+            break
 
     dob = body.get(p+'Birthday', '')
     if dob:
         try:
-            dt = datetime(*map(int, dob.split('-')))
+            year, month, day = map(int, dob.split('-'))
+            # the above raises ValueError if the number of parts isn't 3
+            # or if any part isn't an integer
+            dt = datetime(year, month, day)
             setattr(account, p+'Birthday', (dt - EPOCH).total_seconds())
         except ValueError:
             error = _("Invalid date of birth.")