From 1c9dc02e68a2a7beaa8215db78b1702ee473e25f Mon Sep 17 00:00:00 2001 From: Russell Ballestrini Date: Tue, 25 Jun 2024 00:22:02 +0000 Subject: [PATCH] strip() strings from frontend and fix coupon validation error --- make_post_sell/models/cart.py | 2 +- make_post_sell/views/coupon.py | 4 +- make_post_sell/views/product.py | 14 +++--- make_post_sell/views/shop.py | 82 ++++++++++++++++++--------------- make_post_sell/views/user.py | 4 +- 5 files changed, 56 insertions(+), 50 deletions(-) diff --git a/make_post_sell/models/cart.py b/make_post_sell/models/cart.py index 7e9c6c7..3a44483 100644 --- a/make_post_sell/models/cart.py +++ b/make_post_sell/models/cart.py @@ -405,7 +405,7 @@ class Cart(RBase, Base): ) elif ( self.shop_totals_in_cents[coupon.shop_uuid_str] - < coupon.cart_qualifier + < (coupon.cart_qualifier or 0) ): error_messages.append( "Please review coupon terms: shop total not met." diff --git a/make_post_sell/views/coupon.py b/make_post_sell/views/coupon.py index 16939cd..0dbebf4 100644 --- a/make_post_sell/views/coupon.py +++ b/make_post_sell/views/coupon.py @@ -40,8 +40,8 @@ def coupon(request): @view_config(route_name="coupon_new2", renderer="coupon_new.j2") @shop_owner_required() def coupon_new(request): - code = request.params.get("code") - description = request.params.get("description") + code = request.params.get("code", "").strip() + description = request.params.get("description", "").strip() action_type = request.params.get("action_type") action_value = request.params.get("action_value") max_redemptions = request.params.get("max_redemptions") diff --git a/make_post_sell/views/product.py b/make_post_sell/views/product.py index 4d1ac6a..819e804 100644 --- a/make_post_sell/views/product.py +++ b/make_post_sell/views/product.py @@ -96,9 +96,9 @@ def product(request): @user_required() @shop_editor_required() def product_new(request): - title = request.params.get("title", "") - description = request.params.get("description", "") - price = request.params.get("price", "") + title = request.params.get("title", "").strip() + description = request.params.get("description", "").strip() + price = request.params.get("price", "").strip() is_bundle_checkbox = request.params.get("is_bundle", "off") is_bundle = checkbox_to_bool(is_bundle_checkbox) @@ -174,7 +174,7 @@ def product_edit_description(request): "markup-editor-textarea", # TODO: rename this column to description_raw. product.description, - ) + ).strip() if raw_markup_data and raw_markup_data != product.description: product.set_description(raw_markup_data) @@ -198,8 +198,8 @@ def product_edit(request): product_modified = False product = request.product - title = request.params.get("title", product.title) - description = request.params.get("description", product.description) + title = request.params.get("title", product.title).strip() + description = request.params.get("description", product.description).strip() price = request.params.get("price", product.price) visibility = int(request.params.get("visibility", product.visibility)) uploaded_file_key = request.params.get("uploaded", "") @@ -439,7 +439,7 @@ def product_bundle_edit(request): ("You may only add products to a Product bundle.", "error") ) - bundle_data = request.params.get("bundle-data", None) + bundle_data = request.params.get("bundle-data", "").strip() if bundle_data: products = get_products_by_ids( diff --git a/make_post_sell/views/shop.py b/make_post_sell/views/shop.py index 23ef67e..53940a4 100644 --- a/make_post_sell/views/shop.py +++ b/make_post_sell/views/shop.py @@ -157,10 +157,10 @@ def search(request): redirect_to_route_name="join-or-log-in", ) def shop_new(request): - name = request.params.get("name", "") - phone_number = request.params.get("phone_number", "") - billing_address = request.params.get("billing_address", "") - description = request.params.get("description", "") + name = request.params.get("name", "").strip() + phone_number = request.params.get("phone_number", "").strip() + billing_address = request.params.get("billing_address", "").strip() + description = request.params.get("description", "").strip() if name and description and billing_address and phone_number: if not is_shop_name_valid(name): @@ -297,7 +297,7 @@ def shop_edit_privacy_policy(request): @shop_owner_required() def shop_users(request): shop = request.shop - email_to_invite = request.params.get("email-to-invite") + email_to_invite = request.params.get("email-to-invite").split() role_id = request.params.get("role-id") _email_regex = re.compile("^[^@]+@[^@]+\.[^.@]+$") @@ -358,25 +358,28 @@ def shop_user_remove(request): @shop_owner_required() def shop_settings(request): shop = request.shop - - name = request.params.get("name", shop.name) - phone_number = request.params.get("phone_number", shop.phone_number) - billing_address = request.params.get("billing_address", shop.billing_address) - description = request.params.get("description", shop.description) - domain_name = request.params.get("domain_name", shop.domain_name or "").lower() + name = request.params.get("name", shop.name).strip() + phone_number = request.params.get("phone_number", shop.phone_number).strip() + billing_address = request.params.get( + "billing_address", shop.billing_address + ).strip() + description = request.params.get("description", shop.description).strip() + domain_name = request.params.get("domain_name", shop.domain_name or "").strip().lower() # announcement ribbon settings. - ribbon_text = request.params.get("ribbon_text", shop.ribbon_text) - ribbon_text_color = request.params.get("ribbon_text_color", shop.ribbon_text_color) - ribbon_color_1 = request.params.get("ribbon_color_1", shop.ribbon_color_1) - ribbon_color_2 = request.params.get("ribbon_color_2", shop.ribbon_color_2) + ribbon_text = request.params.get("ribbon_text", shop.ribbon_text).strip() + ribbon_text_color = request.params.get( + "ribbon_text_color", shop.ribbon_text_color + ).strip() + ribbon_color_1 = request.params.get("ribbon_color_1", shop.ribbon_color_1).strip() + ribbon_color_2 = request.params.get("ribbon_color_2", shop.ribbon_color_2).strip() google_analytics_id = request.params.get( "google_analytics_id", shop.google_analytics_id ) plausible_domain_name = request.params.get( - "plausible_domain_name", shop.plausible_domain_name - ) + "plausible_domain_name", shop.plausible_domain_name or "" + ).strip() stripe_public_api_key = request.params.get( "stripe_public_api_key", shop.stripe_public_api_key @@ -429,12 +432,12 @@ def shop_settings(request): msg = ("Invalid phone number. We accept: -.() and numbers.", "error") request.session.flash(msg) - if billing_address != shop.billing_address: + if billing_address and billing_address != shop.billing_address: shop.billing_address = billing_address msg = ("You set the shop's billing address.", "success") request.session.flash(msg) - if description != shop.description: + if description and description != shop.description: shop.description = description msg = ("You set the shop's description.", "success") request.session.flash(msg) @@ -451,17 +454,17 @@ def shop_settings(request): msg = ("Invalid domain name. Please enter a valid domain.", "error") request.session.flash(msg) - if ribbon_text != shop.ribbon_text: + if ribbon_text and ribbon_text != shop.ribbon_text: shop.ribbon_text = ribbon_text msg = ("You set the shop's announcement ribbon text.", "success") request.session.flash(msg) - if ribbon_text_color != shop.ribbon_text_color: + if ribbon_text_color and ribbon_text_color != shop.ribbon_text_color: shop.ribbon_text_color = ribbon_text_color msg = ("You set the shop's announcement ribbon text color.", "success") request.session.flash(msg) - if ribbon_color_1 != shop.ribbon_color_1: + if ribbon_color_1 and ribbon_color_1 != shop.ribbon_color_1: shop.ribbon_color_1 = ribbon_color_1 msg = ( "You set the shop's announcement ribbon background color 1.", @@ -469,7 +472,7 @@ def shop_settings(request): ) request.session.flash(msg) - if ribbon_color_2 != shop.ribbon_color_2: + if ribbon_color_2 and ribbon_color_2 != shop.ribbon_color_2: shop.ribbon_color_2 = ribbon_color_2 msg = ( "You set the shop's announcement ribbon background color 2.", @@ -477,12 +480,15 @@ def shop_settings(request): ) request.session.flash(msg) - if google_analytics_id != shop.google_analytics_id: + if google_analytics_id and google_analytics_id != shop.google_analytics_id: shop.google_analytics_id = google_analytics_id msg = ("You set the shop's Google Analytics Id.", "success") request.session.flash(msg) - if plausible_domain_name != shop.plausible_domain_name: + if ( + plausible_domain_name + and plausible_domain_name != shop.plausible_domain_name + ): shop.plausible_domain_name = plausible_domain_name msg = ("You set the shop's Plausible Analytics Domain Name.", "success") request.session.flash(msg) @@ -630,19 +636,19 @@ def shop_settings(request): signed_posts[file_key]["fields"].update(condition) return { - "name": name, - "description": description, - "billing_address": billing_address, - "phone_number": phone_number, - "domain_name": domain_name, - "ribbon_text": ribbon_text, - "ribbon_text_color": ribbon_text_color, - "ribbon_color_1": ribbon_color_1, - "ribbon_color_2": ribbon_color_2, - "google_analytics_id": google_analytics_id, - "plausible_domain_name": plausible_domain_name, - "stripe_public_api_key": stripe_public_api_key, - "stripe_secret_api_key": stripe_secret_api_key, + "name": shop.name, + "description": shop.description, + "billing_address": shop.billing_address, + "phone_number": shop.phone_number, + "domain_name": shop.domain_name or "", + "ribbon_text": shop.ribbon_text or "", + "ribbon_text_color": shop.ribbon_text_color or "", + "ribbon_color_1": shop.ribbon_color_1 or "", + "ribbon_color_2": shop.ribbon_color_2 or "", + "google_analytics_id": shop.google_analytics_id or "", + "plausible_domain_name": shop.plausible_domain_name or "", + "stripe_public_api_key": shop.stripe_public_api_key or "", + "stripe_secret_api_key": shop.stripe_secret_api_key or "", "signed_posts": signed_posts, "get_endpoints": get_endpoints, } diff --git a/make_post_sell/views/user.py b/make_post_sell/views/user.py index 1b495e5..67ada32 100644 --- a/make_post_sell/views/user.py +++ b/make_post_sell/views/user.py @@ -42,8 +42,8 @@ def user_products(request): def user_settings(request): user = request.user - name = request.params.get("name", user.name) - full_name = request.params.get("full_name", user.full_name) + name = request.params.get("name", user.name).strip() + full_name = request.params.get("full_name", user.full_name).strip() if name and name != user.name: if not is_user_name_valid(name):