Skip to content

Commit 554f779

Browse files
committed
API: handle project/version not found at permission class
When a request is made with a URL containing an invalid version (e.g. http://test-builds.devthedocs.org/_/addons/?url=http%3A%2F%2Ftest-builds.devthedocs.org%2Fen%<invalid-version-here>%2F) this class fails and returns a 500. This fixes this issue by letting the request to continue and be handled downstream by the view itself. The error has been reported on Sentry: https://read-the-docs.sentry.io/issues/4457263897/events/recommended/?project=148442&query=is%3Aunresolved+%21message%3A%22%21message%3A%22%21message%3A%22SystemExit%22+%21message%3A%22frame-ancestors%22&referrer=recommended-event&stream_index=1 I will add a specific test for this in #10685.
1 parent 1692cf9 commit 554f779

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

readthedocs/api/v2/permissions.py

+7
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,13 @@ class IsAuthorizedToViewVersion(permissions.BasePermission):
4040
def has_permission(self, request, view):
4141
project = view._get_project()
4242
version = view._get_version()
43+
44+
if not project or not version:
45+
# Allow the request if there is no project/version.
46+
# It will hit the real view and it will be handled properly:
47+
# return 404 or just an empty project/version field.
48+
return True
49+
4350
has_access = (
4451
Version.objects.public(
4552
user=request.user,

0 commit comments

Comments
 (0)