Bugfix/url param validation

backend/donations/admin/causes.py

@@ -47,11 +47,11 @@ def generate_donations_archive(self, request, queryset: QuerySet[Cause]):
 
             try:
                 if settings.FORMS_DOWNLOAD_METHOD == "async":
-                    call_command("download_donations", new_job.id)
+                    call_command("download_donations", new_job.pk)
                 else:
-                    call_command("download_donations", new_job.id, "--run")
+                    call_command("download_donations", new_job.pk, "--run")
 
-                ngo_names.append(f"{ngo.id} - {ngo.name}")
+                ngo_names.append(f"{ngo.pk} - {ngo.name}")
             except Exception as e:
                 logger.error(e)
 

backend/donations/admin/ngos.py

@@ -445,7 +445,7 @@ def _change_owner(self, ngo: Ngo, new_owner: User):
 
     @action(description=_("Change owner"))
     def change_owner(self, request: HttpRequest, object_id):
-        ngo = Ngo.objects.get(id=object_id)
+        ngo = Ngo.objects.get(pk=object_id)
 
         if request.method == "POST":
             form = ChangeNgoOwnerForm(request.POST)

backend/donations/management/commands/generate_donations.py

@@ -79,7 +79,7 @@ def _generate_pdfs_for_donations(new_donors: QuerySet[Donor]):
         target_org = options.get("org", None)
 
         if target_org:
-            ngos = [Ngo.objects.get(id=target_org)]
+            ngos = [Ngo.objects.get(pk=target_org)]
         else:
             ngos = list(Ngo.active.all())
 

backend/donations/models/donors.py

@@ -14,7 +14,7 @@
 
 def year_ngo_donor_directory_path(subdir: str, instance: "Donor", filename: str) -> str:
     """
-    The file will be uploaded to MEDIA_ROOT/<subdir>/<year>/c-<cause.id>-<cause.hash>/<id>_<hash>_<filename>
+    The file will be uploaded to MEDIA_ROOT/<subdir>/<year>/c-<cause.pk>-<cause.hash>/<id>_<hash>_<filename>
     """
     timestamp = timezone.now()
     year = timestamp.date().year
@@ -321,7 +321,7 @@ def form_url(self) -> str:
             "donor-download-link",
             kwargs={
                 "donor_date_str": self.date_str,
-                "donor_id": self.id,
+                "donor_id": self.pk,
                 "donor_hash": self.donation_hash,
             },
         )

backend/donations/models/ngos.py

@@ -448,7 +448,7 @@ def full_registration_number(self):
     @staticmethod
     def delete_prefilled_form(ngo_id):
         try:
-            ngo = Ngo.objects.get(id=ngo_id)
+            ngo = Ngo.objects.get(pk=ngo_id)
         except Ngo.DoesNotExist:
             logging.info("NGO id %d does not exist for prefilled form deletion", ngo_id)
             return

backend/donations/views/account_management.py

@@ -36,7 +36,7 @@ def _send_password_reset_email(self, request: HttpRequest, user: UserModel):
                 "verification",
                 kwargs={
                     "verification_type": "p",
-                    "user_id": user.id,
+                    "user_id": user.pk,
                     "signup_token": user.refresh_token(),
                 },
             )
@@ -278,7 +278,7 @@ def post(self, request, *args, **kwargs):
                 "verification",
                 kwargs={
                     "verification_type": "v",
-                    "user_id": user.id,
+                    "user_id": user.pk,
                     "signup_token": user.refresh_token(),
                 },
             )

backend/donations/views/api.py

@@ -134,9 +134,9 @@ def generate_archive_for_cause_slug(self, cause_slug: str | None, request) -> Jo
 
         try:
             if settings.FORMS_DOWNLOAD_METHOD == "async":
-                call_command("download_donations", new_job.id)
+                call_command("download_donations", new_job.pk)
             else:
-                call_command("download_donations", new_job.id, "--run")
+                call_command("download_donations", new_job.pk, "--run")
         except Exception as e:
             logging.error(e)
 

backend/donations/views/download_donations/main.py

@@ -34,7 +34,7 @@
 
 def download_donations_job(job_id: int = 0):
     try:
-        job: Job = Job.objects.select_related("cause").get(id=job_id)
+        job: Job = Job.objects.select_related("cause").get(pk=job_id)
     except Job.DoesNotExist:
         logger.error("Job with ID %d does not exist", job_id)
         return
@@ -53,7 +53,7 @@ def download_donations_job(job_id: int = 0):
 
         return
 
-    file_name = f"n{cause.id:06d}__{datetime.strftime(timestamp, '%Y%m%d_%H%M')}.zip"
+    file_name = f"n{cause.pk:06d}__{datetime.strftime(timestamp, '%Y%m%d_%H%M')}.zip"
 
     with tempfile.TemporaryDirectory(prefix=f"rdr_zip_{job_id:06d}_") as tmp_dir_name:
         logger.info("Created temporary directory '%s'", tmp_dir_name)
@@ -70,7 +70,7 @@ def download_donations_job(job_id: int = 0):
             return
 
     mail_context = {
-        "action_url": build_uri(reverse("my-organization:archive-download-link", kwargs={"job_id": job.id})),
+        "action_url": build_uri(reverse("my-organization:archive-download-link", kwargs={"job_id": job.pk})),
     }
     mail_context.update(extend_email_context())
 
@@ -113,7 +113,7 @@ def _package_donations(tmp_dir_name: str, donations: QuerySet[Donor], cause: Cau
                 continue
 
             donation_timestamp: datetime = donation_object.date_created
-            filename = f"{datetime.strftime(donation_timestamp, '%Y%m%d_%H%M')}__d{donation_object.id:06d}.pdf"
+            filename = f"{datetime.strftime(donation_timestamp, '%Y%m%d_%H%M')}__d{donation_object.pk:06d}.pdf"
 
             retries_left = 2
             while retries_left > 0:
@@ -258,9 +258,9 @@ def _get_pdf_url(donation: Donor) -> str:
         source_url = ""
 
     if not source_url:
-        logger.info("Donation #%d has no PDF URL", donation.id)
+        logger.info("Donation #%d has no PDF URL", donation.pk)
     else:
-        logger.debug("Donation #%d PDF URL: '%s'", donation.id, source_url)
+        logger.debug("Donation #%d PDF URL: '%s'", donation.pk, source_url)
 
     return source_url
 

backend/donations/views/ngo_account/causes.py

@@ -242,7 +242,11 @@ def get_cause(self, *, ngo: Ngo, cause_id: int | None) -> Cause | None:
         if not (ngo and cause_id):
             raise Http404
 
-        cause = Cause.objects.filter(pk=cause_id, ngo=ngo).first()
+        try:
+            cause = Cause.objects.filter(pk=cause_id, ngo=ngo).first()
+        except ValueError:
+            raise Http404
+
         if not cause:
             raise Http404
 

backend/donations/views/ngo_account/common.py

@@ -206,7 +206,7 @@ def get_downloadable_object(self, user: User, pk: int):
 
         try:
             result = self.model.objects.get(**queryset)
-        except ObjectDoesNotExist:
+        except (ObjectDoesNotExist, ValueError):
             return None
 
         return result

backend/donations/views/ngo_account/my_organization.py

@@ -145,7 +145,7 @@ def post(self, request, *args, **kwargs):
             user.ngo = ngo
             user.save()
         elif must_refresh_prefilled_form:
-            async_wrapper(delete_ngo_prefilled_forms, ngo_id=ngo.id)
+            async_wrapper(delete_ngo_prefilled_forms, ngo_id=ngo.pk)
 
         context["ngo"] = ngo
 

backend/donations/views/ngo_account/redirections.py

@@ -278,7 +278,7 @@ def get(self, request: HttpRequest, job_id, *args, **kwargs):
             # The admin can always get the download link
             try:
                 job = Job.objects.get(pk=job_id)
-            except Job.DoesNotExist:
+            except (Job.DoesNotExist, ValueError):
                 raise Http404
 
         elif not user.ngo:
@@ -293,7 +293,7 @@ def get(self, request: HttpRequest, job_id, *args, **kwargs):
             # Check that the requested job belongs to the current user
             try:
                 job = Job.objects.get(pk=job_id, ngo=user.ngo)
-            except Job.DoesNotExist:
+            except (Job.DoesNotExist, ValueError):
                 raise Http404
 
         # Check that the job has a zip file
@@ -319,7 +319,7 @@ def get(self, request, form_id, *args, **kwargs):
 
         try:
             donor = Donor.objects.get(pk=form_id, ngo=ngo)
-        except Donor.DoesNotExist:
+        except (Donor.DoesNotExist, ValueError):
             raise Http404
 
         if not donor.pdf_file:
@@ -351,7 +351,7 @@ def post(self, request, form_id, *args, **kwargs):
 
         try:
             donor = Donor.objects.get(pk=form_id, ngo=ngo, has_signed=True)
-        except Donor.DoesNotExist:
+        except (Donor.DoesNotExist, ValueError):
             raise Http404
 
         donor.is_available = False

backend/donations/workers/update_organization.py

@@ -198,17 +198,17 @@ def _update_local_ngo_with_ngohub_data(ngo: Ngo, ngohub_ngo: Organization) -> di
         ngo.full_clean()
         ngo.save()
     except DatabaseError as e:
-        logger.exception(f"Database error while saving NGO {ngo.id}:\n{e}")
-        errors.append(f"Database error while saving NGO {ngo.id}:\n{e}")
+        logger.exception(f"Database error while saving NGO {ngo.pk}:\n{e}")
+        errors.append(f"Database error while saving NGO {ngo.pk}:\n{e}")
         return {
-            "ngo_id": ngo.id,
+            "ngo_id": ngo.pk,
             "errors": errors,
         }
     except ValidationError as e:
-        logger.exception(f"Validation error while updating NGO {ngo.id}:\n{e}")
-        errors.append(f"Validation error while updating NGO {ngo.id}:\n{e}")
+        logger.exception(f"Validation error while updating NGO {ngo.pk}:\n{e}")
+        errors.append(f"Validation error while updating NGO {ngo.pk}:\n{e}")
         return {
-            "ngo_id": ngo.id,
+            "ngo_id": ngo.pk,
             "errors": errors,
         }
 
@@ -225,7 +225,7 @@ def _update_local_ngo_with_ngohub_data(ngo: Ngo, ngohub_ngo: Organization) -> di
     ngo.save()
 
     task_result: dict = {
-        "ngo_id": ngo.id,
+        "ngo_id": ngo.pk,
         "errors": errors,
     }
 
@@ -249,7 +249,7 @@ def _update_organization_task(organization_id: int, token: str = "") -> dict[str
     except HubHTTPException as e:
         logger.exception(f"Error while fetching NGO Hub data for NGO ID {ngohub_id}:\n{e}")
         return {
-            "ngo_id": ngo.id,
+            "ngo_id": ngo.pk,
             "errors": [f"Error while fetching NGO Hub data for NGO ID {ngohub_id}:\n{e}"],
         }
 
@@ -294,7 +294,7 @@ def create_organization_for_user(user, ngohub_org_data: Organization) -> Ngo:
         _update_local_ngo_with_ngohub_data(ngo, ngohub_org_data)
     except DatabaseError as e:
         logger.exception(
-            f"Database error while creating NGO for user {user.id} with NGO Hub ID {ngohub_org_data.id}:\n{e}"
+            f"Database error while creating NGO for user {user.pk} with NGO Hub ID {ngohub_org_data.id}:\n{e}"
         )
         ngo.delete()
         raise e

backend/partners/admin.py

@@ -138,7 +138,7 @@ def _invite_new_owner(self, request: HttpRequest, form: AddNewCausePartnerManage
                 "verification",
                 kwargs={
                     "verification_type": "p",
-                    "user_id": new_user.id,
+                    "user_id": new_user.pk,
                     "signup_token": new_user.refresh_token(),
                 },
             )