Ticket #10927: 10927.diff

django/contrib/contenttypes/views.py

@@ -1 +1 @@
 from django import http
 from django.contrib.contenttypes.models import ContentType
 from django.contrib.sites.models import Site
-from django.core.exceptions import ObjectDoesNotExist
+from django.core.exceptions import ObjectDoesNotExist, ValidationError
 
 def shortcut(request, content_type_id, object_id):
     "Redirect to an object's page based on a content-type ID and an object ID."
     # Look up the object, making sure it's got a get_absolute_url() function.
+    def raise_invalid():
+        raise http.Http404("Content type %s object %s doesn't exist" % (content_type_id, object_id))
+    try:
+        content_type_id = int(content_type_id)
+    except ValueError:
+        raise_invalid()
     try:
         content_type = ContentType.objects.get(pk=content_type_id)
+    except ObjectDoesNotExist:
+        raise_invalid()
+    try:
+        object_id = content_type.model_class()._meta.pk.to_python(object_id)
+    except ValidationError:
+        raise_invalid()
+    try:
         obj = content_type.get_object_for_this_type(pk=object_id)
     except ObjectDoesNotExist:
-        raise http.Http404("Content type %s object %s doesn't exist" % (content_type_id, object_id))
+        raise_invalid()
     try:
         absurl = obj.get_absolute_url()
     except AttributeError:

tests/regressiontests/views/tests/defaults.py

@@ -10 +10 @@
     """Test django views in django/views/defaults.py"""
     fixtures = ['testdata.json']
 
-    def test_shorcut_with_absolute_url(self):
+    def test_shortcut_with_absolute_url(self):
         "Can view a shortcut an Author object that has with a get_absolute_url method"
         for obj in Author.objects.all():
             short_url = '/views/shortcut/%s/%s/' % (ContentType.objects.get_for_model(Author).id, obj.pk)
@@ -25 +25 @@
             response = self.client.get(short_url)
             self.assertEquals(response.status_code, 404)
 
+    def test_wrong_type_pk(self):
+        an_article = Article.objects.all()[0]
+        short_url = '/views/shortcut/%s/%s/' % (ContentType.objects.get_for_model(Article).id, 'nobody/expects')
+        response = self.client.get(short_url)
+        self.assertEquals(response.status_code, 404)
+
+    def test_shortcut_bad_pk(self):
+        "Shortcuts for an object that has with a get_absolute_url method raises 404"
+        short_url = '/views/shortcut/%s/%s/' % (ContentType.objects.get_for_model(Article).id, '4242424242')
+        response = self.client.get(short_url)
+        self.assertEquals(response.status_code, 404)
+
+    def test_nonint_content_type(self):
+        an_article = Article.objects.all()[0]
+        short_url = '/views/shortcut/%s/%s/' % ('spam', an_article.pk)
+        response = self.client.get(short_url)
+        self.assertEquals(response.status_code, 404)
+
+    def test_bad_content_type(self):
+        an_article = Article.objects.all()[0]
+        short_url = '/views/shortcut/%s/%s/' % (4242424242, an_article.pk)
+        response = self.client.get(short_url)
+        self.assertEquals(response.status_code, 404)
+
     def test_page_not_found(self):
         "A 404 status is returned by the page_not_found view"
         non_existing_urls = ['/views/non_existing_url/', # this is in urls.py