Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion ledger/accounts/forms.py
Original file line number Diff line number Diff line change
Expand Up @@ -206,7 +206,14 @@ def __init__(self, *args, **kwargs):
self.helper.add_input(Submit('save', 'Save', css_class='btn-lg'))
self.helper.add_input(Submit('cancel', 'Cancel', css_class='btn-lg btn-danger'))

person_id = self.initial['id']
person_id = None
if "id" in self.initial:
person_id = self.initial['id']
if person_id is None:
if "email" in self.initial:
print (self.initial['email'])
person_id = EmailUser.objects.get(email=self.initial['email'])
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The user lookup by email assigns the full EmailUser object to person_id instead of its ID, causing a ValueError on a later type conversion. It also lacks a try...except block, risking an unhandled DoesNotExist exception.
Severity: HIGH

Suggested Fix

Modify the query to retrieve the user's ID directly by appending .id or .pk. Additionally, wrap the EmailUser.objects.get() call in a try...except EmailUser.DoesNotExist block to gracefully handle cases where the email does not exist in the database.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: ledger/accounts/forms.py#L215

Potential issue: When the form is initialized with an email but no ID, the code at
`ledger/accounts/forms.py:215` looks up the user. This lookup has two failure modes.
First, if a user is found, the entire `EmailUser` object is assigned to `person_id`, not
its integer ID. This object is later stringified (e.g., to 'user@example.com') and
stored in a hidden form field. When the form is submitted, an attempt to convert this
string back to an integer via `int()` will raise a `ValueError`. Second, if no user is
found for the provided email, the `EmailUser.objects.get()` call will raise an unhandled
`EmailUser.DoesNotExist` exception, causing a server error.

Did we get this right? 👍 / 👎 to inform future reviews.


self.fields['email'].required = email_required

# some form renderers use widget's is_required field to set required attribute for input element
Expand Down
Loading