diff --git a/src/documents/filters.py b/src/documents/filters.py index ff2cc2936..fd52e43aa 100644 --- a/src/documents/filters.py +++ b/src/documents/filters.py @@ -778,8 +778,9 @@ class DocumentsOrderingFilter(OrderingFilter): param = request.query_params.get("ordering") if param and self.prefix in param: custom_field_id = int(param.split(self.prefix)[1]) - field = CustomField.objects.get(pk=custom_field_id) - if not field: + try: + field = CustomField.objects.get(pk=custom_field_id) + except CustomField.DoesNotExist: raise ValueError("Custom field not found") annotation = None @@ -877,6 +878,7 @@ class DocumentsOrderingFilter(OrderingFilter): ) if not annotation: + # Only happens if a new data type is added and not handled here raise ValueError("Invalid custom field data type") queryset = ( diff --git a/src/documents/tests/test_api_documents.py b/src/documents/tests/test_api_documents.py index 35b6a2b89..048449fd4 100644 --- a/src/documents/tests/test_api_documents.py +++ b/src/documents/tests/test_api_documents.py @@ -2909,3 +2909,40 @@ class TestDocumentApiCustomFieldsSorting(DirectoriesMixin, APITestCase): [results[0]["id"], results[1]["id"], results[2]["id"]], [self.doc1.id, self.doc3.id, self.doc2.id], ) + + def test_document_custom_fields_sorting_invalid(self): + """ + GIVEN: + - Documents with custom fields + WHEN: + - API request for document filtering with invalid custom field sorting + THEN: + - 400 is returned + """ + + with self.assertRaises(ValueError): + response = self.client.get( + "/api/documents/?ordering=custom_field_999", + ) + self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST) + + def test_document_custom_fields_sorting_invalid_data_type(self): + """ + GIVEN: + - Documents with custom fields + WHEN: + - API request for document filtering with a custom field sorting with a new (unhandled) data type + THEN: + - 400 is returned + """ + + custom_field = CustomField.objects.create( + name="custom field", + data_type="foo", + ) + + with self.assertRaises(ValueError): + response = self.client.get( + f"/api/documents/?ordering=custom_field_{custom_field.pk}", + ) + self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)