fixes bug 889491 - Improve error messages for invalid queries

[peterbe]

Don't ask why I dedicated an hour of my Friday afternoon to this. The short answer was that I was just curious. I wanted to play with the handler400 but that's not at all what that's for. :)

Before:

After:

[adngdb]

Are you sure this is really safe? Could you add tests that verify it can't lead to an XSS attack for example?

[peterbe]

Will do.

[peterbe]

I couldn't think of a way to test that. So I hijacked one of the form validation functions and put in raise forms.ValidationError('<script> ...
This is what it looked like;
http://jmp.sh/CRDYEwV

[adngdb]

I see you applied this new behavior to a handful of views. Is there not a way to apply to every view we have? Any 400 page should behave like that imo, and having to add another decorator to every view sounds painful.

[peterbe]

Is there not a way to apply to every view we have?

Yes, mayhaps if we write a middleware. If we just make sure to not meddle if the request is an AJAX one it might just work.

[peterbe]

@adngdb See the new update. I managed to do it with a piece of middleware. Now, if any view does something like...

def myview(request):
    if condition:
        return http.HttpResponseBadRequest('Bad!')

it will be rendered as the 400.html template.

I've tested this...

• on the report index page, by replacing one of the characters in the crash ID with an x
• on the topcrashers page, by setting &days=xxx
• on the signature report, removing the &signature=...
• on the home page, by setting &days=xxx
• on the supersearch page, by entering a date that isn't a date (Note! Here it should NOT use 400.html)

[adngdb]

This looks good, but it needs to be rebased!