801927 - [socorro-crashstats] /daily and /query need form validation

Status: RESOLVED FIXED

(Socorro :: Webapp, task)

Description

[Robert Helmer [:rhelmer]]

Many of the bugs that stephend's fuzzer and manual QA are turning up are due to inadequate server-side form validation.

The /daily and /query views in particular both use very similar custom form implementations, instead of something more standard like django forms.

I tried doing /daily with django forms but gave up for the initial release, since I think maintaining backwards compatibility will simply be too much work to do on such a short time frame, but I'll leave the fix here up to :peterbe :)

Comment 1

[[DEACTIVATED] Adrian Gaudebert]

I have form validation for /query done in a branch. Will open a PR today, along with other things search-related.

Comment 2

[Peter Bengtsson [:peterbe]]

(In reply to Adrian Gaudebert [:adrian] from comment #1)
> I have form validation for /query done in a branch. Will open a PR today,
> along with other things search-related.

Looking forward to it! I almost got started and would have wasted my time. Great news!

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

For those of us playing at home, it's https://github.com/mozilla/socorro-crashstats/pull/160

Comment 4

[Peter Bengtsson [:peterbe]]

PR for the /daily is here: 
https://github.com/mozilla/socorro-crashstats/pull/167

Comment 6

[[github robot]]

Commit pushed to master at https://github.com/mozilla/socorro-crashstats

https://github.com/mozilla/socorro-crashstats/commit/e9d9fc2774111412b36b6945042b389dda92afb5
bug 801927 - /daily report to use django forms api to validate, r=rhelmer

Comment 7

[Peter Bengtsson [:peterbe]]

Hurray! Stephen, bring it on!