Repository: dotkom/onlineweb4

Issue:
Nibble api silently succeeds it should fail.
<!-- If this is a security issue or information leakage (having access to something you (probably) shouldn't), please send an email rather than opening a public issue. -->

## What kind of an issue is this?
- Bug report

When not providing a quantity field (or names the quantity field wrongly) the api assumes the user only wants to buy one of the item.


## What is the expected behavior?
All the fields in the api should be required to be specified and the api should return an error when fields aren't specified.

## What is the current behavior?
Current behavior is that the api falls back to a default value of 1 for quantity.



Discussion:
I would say that this is an error on the database/data validation layer, not necessarily in the API.

https://github.com/dotkom/onlineweb4/blob/68f54ed7bbaf258fd99de78ba922963a7785f8c2/apps/shop/models.py#L22

Relevant source code. I'd suggest removing the default value, which will fail to validate the request if the quantity value is missing, rather than automatically setting it to 1.
Completely agree with @sklirg. Although this relatively large fuck-up is clearly my fault it could have been avoided by simply throwing an error (or however you handle it in Django) when no quantity field is provided. I also think this way of handling misformatted errors should be employed everywhere, and rather send back a 400 Bad Request.
That's exactly how Django rest framework works if missing required
parameters 😉

On Thu, Jan 17, 2019, 10:21 Fredrik August Madsen-Malmo <
notifications@github.com> wrote:

> Completely agree with @sklirg <https://github.com/sklirg>. Although this
> relatively large fuck-up is clearly my fault it could have been avoided by
> simply throwing when no quantity field is provided. I also think this way
> of handling misformatted errors should be employed everywhere, and rather
> send back a 400 Bad Request.
>
> —
> You are receiving this because you were mentioned.
>
>
> Reply to this email directly, view it on GitHub
> <https://github.com/dotkom/onlineweb4/issues/2189#issuecomment-455100163>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AFK964FCoc3h7rvcirRdFiK7jEO3SX5vks5vEECVgaJpZM4aDvZM>
> .
>


Resolving patch:
diff --git a/apps/shop/migrations/0004_auto_20190226_1239.py b/apps/shop/migrations/0004_auto_20190226_1239.py
new file mode 100644
--- /dev/null
+++ b/apps/shop/migrations/0004_auto_20190226_1239.py
@@ -0,0 +1,19 @@
+# Generated by Django 2.0.13 on 2019-02-26 11:39
+
+import django.core.validators
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('shop', '0003_magictoken'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='order',
+            name='quantity',
+            field=models.PositiveIntegerField(validators=[django.core.validators.MinValueValidator(1)]),
+        ),
+    ]
diff --git a/apps/shop/models.py b/apps/shop/models.py
--- a/apps/shop/models.py
+++ b/apps/shop/models.py
@@ -19,7 +19,7 @@ class Order(models.Model):
     # Price of product when paid
     price = models.DecimalField(max_digits=10, decimal_places=2, blank=True)
     # Quantity of products ordered
-    quantity = models.PositiveIntegerField(default=1, validators=[MinValueValidator(1)])
+    quantity = models.PositiveIntegerField(validators=[MinValueValidator(1)])
 
     def total_price(self):
         return self.content_object.price * self.quantity


Test patch: