Skip to content

fix(core): return 404 from marker_preview when ?id= is missing, non-int, or unknown#915

Open
SAY-5 wants to merge 1 commit intomemeLab:developfrom
SAY-5:fix/marker-preview-404
Open

fix(core): return 404 from marker_preview when ?id= is missing, non-int, or unknown#915
SAY-5 wants to merge 1 commit intomemeLab:developfrom
SAY-5:fix/marker-preview-404

Conversation

@SAY-5
Copy link
Copy Markdown

@SAY-5 SAY-5 commented Apr 18, 2026

What

marker_preview in src/core/views/views.py calls:

@require_http_methods(["GET"])
def marker_preview(request):
    marker_id = request.GET.get("id")
    marker = Marker.objects.get(id=marker_id)
    ...

marker_id is whatever came off the query string: None, a numeric string, or arbitrary junk. Marker.objects.get(id=marker_id) turns every non-happy-path into an HTTP 500 via Django's default handler:

  1. ?id missing → marker_id is None → ORM issues id IS NULLDoesNotExist.
  2. ?id=abc (or any non-numeric junk bots send) → DB driver rejects the integer cast → ValueError / DataError.
  3. ?id=99999 (deleted / never existed) → DoesNotExist.

All three should be 404s, not server errors. The /marker/preview endpoint is unauthenticated and reachable from marker thumbnails in the collection UI, so stale links and crawlers reliably log 500s in the error tracker, drowning real bugs.

Fix

Same pattern already used for exhibit_detail and related_content in this module: coerce the id to int first (Http404 on failure), then fetch via get_object_or_404.

marker_id = request.GET.get("id")
try:
    marker_id = int(marker_id)
except (TypeError, ValueError):
    raise Http404
marker = get_object_or_404(Marker, id=marker_id)

get_object_or_404 and Http404 are already imported from django.shortcuts / django.http at the top of the file; no new imports needed. Behaviour for a valid, existing marker id is unchanged.

Fixes #847

…nt, or unknown

marker_preview fetched the marker with Marker.objects.get(id=marker_id)
where marker_id came straight off request.GET.get("id"). Three failure
modes all reach Django's default 500 handler:

  1. ?id missing entirely: marker_id is None; the ORM issues a query
     with id IS NULL which then raises DoesNotExist.
  2. ?id=abc (or any non-numeric junk a crawler supplies): the DB
     driver rejects the cast with ValueError / DataError.
  3. ?id=99999 (deleted or never existed): DoesNotExist.

All three are 404s, not server errors. /marker/preview is unauthenticated
and reachable from links in the collection UI, so stale links + bots
reliably produce 500s in the error tracker.

Coerce marker_id to int first (Http404 on failure) and fetch via
get_object_or_404, matching the pattern already used by exhibit_detail
and related_content in the same module. get_object_or_404 and Http404
are already imported.

Fixes memeLab#847

Signed-off-by: SAY-5 <SAY-5@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

marker_preview uses Marker.objects.get() without exception handling

1 participant