tricycle/predictionbook — pull request #57 by foxbenjaminfox (2014-06-10 11:52:40+00:00)
Title: Bugfix for deadline validation

I found a **very** nasty bug in the deadline validation code.

When I tried exploiting it on my development server, it took down the site. I haven't dared to see if it would do the same in production, but I see no reason why it wouldn't.

The previous code did indeed check to make sure the deadline wasn't to far in the future to be safely storable, but there were two loopholes:

- There were no checks to ensure that the deadlines aren't to far in the *past* to be storable. If you gave a prediction the deadline of "10000000 years ago", it would not be caught the way a deadline of "10000000 years from now" would be, and so promptly crash the site.

- The check was only made on creation of the prediction: If you made a prediction with a valid deadline, you could then edit its deadline to whatever you wanted without triggering validation, and thus crash the site.

I fixed both those loopholes, and added unit tests to ensure that they are correctly handled.