From db08ef7a68e47ed1bcc9131ca234046cd1d9ffec Mon Sep 17 00:00:00 2001
From: Yohan Boniface <yb@enix.org>
Date: Wed, 3 Apr 2019 16:08:09 +0200
Subject: [PATCH] Deal with empty quantities in place order

A user may add a value in place of the "0" and then delete it,
so it will send an empty string to the server.
---
 copanier/__init__.py | 7 +++++--
 tests/test_views.py  | 9 +++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/copanier/__init__.py b/copanier/__init__.py
index 631ee04..8cdfd23 100644
--- a/copanier/__init__.py
+++ b/copanier/__init__.py
@@ -5,7 +5,7 @@ from time import perf_counter
 import ujson as json
 import minicli
 from jinja2 import Environment, PackageLoader, select_autoescape
-from roll import Roll, Response
+from roll import Roll, Response, HttpError
 from roll.extensions import cors, options, traceback, simple_server, static
 
 from . import config, reports, session, utils, emails, loggers
@@ -222,7 +222,10 @@ async def place_order(request, response, id):
         form = request.form
         order = Order(paid=form.bool("paid", False))
         for product in delivery.products:
-            quantity = form.int(product.ref, 0)
+            try:
+                quantity = form.int(product.ref, 0)
+            except HttpError:
+                continue
             if quantity:
                 order.products[product.ref] = ProductOrder(wanted=quantity)
         if not delivery.orders:
diff --git a/tests/test_views.py b/tests/test_views.py
index 33d7224..cb19be0 100644
--- a/tests/test_views.py
+++ b/tests/test_views.py
@@ -76,6 +76,15 @@ async def test_place_empty_order_should_delete_previous(client, delivery):
     assert not delivery.orders
 
 
+async def test_place_order_with_empty_string(client, delivery):
+    delivery.persist()
+    body = {"123": ""}  # User deleted the field value.
+    resp = await client.post(f"/livraison/{delivery.id}/commander", body=body)
+    assert resp.status == 302
+    delivery = Delivery.load(id=delivery.id)
+    assert not delivery.orders
+
+
 async def test_change_paid_status_when_placing_order(client, delivery):
     delivery.persist()
     body = {