Fix: now applying the same verifications when creating or editing comments

isso/tests/test_comments.py

@@ -391,6 +391,22 @@ def testUpdate(self):
         self.assertEqual(rv['website'], 'http://example.com/')
         self.assertIn('modified', rv)
 
+    def testUpdateForbidden(self):
+
+        self.post('/new?uri=test', data=json.dumps({'text': 'Hello world!'}))
+
+        resp = self.put('/id/1', data=json.dumps({}))
+        self.assertEqual(resp.status, '400 BAD REQUEST')
+        self.assertIn('text is missing', resp.text)
+
+        resp = self.put('/id/1', data=json.dumps({'text': ''}))
+        self.assertEqual(resp.status, '400 BAD REQUEST')
+        self.assertIn('text is too short', resp.text)
+
+        resp = self.put('/id/1', data=json.dumps({'text': 'Hello again!', 'website': '[email protected]'}))
+        self.assertEqual(resp.status, '400 BAD REQUEST')
+        self.assertIn('Website not Django-conform', resp.text)
+
     def testDelete(self):
 
         self.post('/new?uri=%2Fpath%2F',

isso/views/comments.py

@@ -539,12 +539,13 @@ def edit(self, environ, request, id):
 
         data = request.json
 
-        if data.get("text") is None or len(data["text"]) < 3:
-            raise BadRequest("no text given")
-
         for key in set(data.keys()) - set(["text", "author", "website"]):
             data.pop(key)
 
+        valid, reason = API.verify(data)
+        if not valid:
+            return BadRequest(reason)
+
         data['modified'] = time.time()
 
         with self.isso.lock: