Skip to content

Commit aa0359b

Browse files
committed
fix: Add server checks for ticket price
1 parent a1fae56 commit aa0359b

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

app/api/tickets.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,13 @@
2020
from app.api.helpers.exceptions import ConflictException, MethodNotAllowed, UnprocessableEntity
2121
from app.api.helpers.db import get_count
2222

23+
24+
def validate_ticket_price(ticket_type, price):
25+
if ticket_type != 'free' and int(price) <= 0:
26+
raise UnprocessableEntity(
27+
{'price': price}, "Price of a paid/donation ticket must be greater than zero")
28+
29+
2330
class TicketListPost(ResourceList):
2431
"""
2532
Create and List Tickets
@@ -59,6 +66,7 @@ def before_create_object(self, data, view_kwargs):
5966
if not event.is_payment_enabled():
6067
raise UnprocessableEntity(
6168
{'event_id': data['event']}, "Event having paid ticket must have a payment method")
69+
validate_ticket_price(data.get('type'), data.get('price'))
6270

6371
schema = TicketSchema
6472
methods = ['POST', ]
@@ -181,6 +189,8 @@ def before_update_object(self, ticket, data, view_kwargs):
181189
if not event.is_payment_enabled():
182190
raise UnprocessableEntity(
183191
{'event_id': ticket.event.id}, "Event having paid ticket must have a payment method")
192+
if data.get('price') and data.get('type'):
193+
validate_ticket_price(data.get('type'), data.get('price'))
184194

185195
decorators = (api.has_permission('is_coorganizer', fetch='event_id',
186196
fetch_as="event_id", model=Ticket, methods="PATCH,DELETE"),)

0 commit comments

Comments
 (0)