Invalid requests from frontend

[iamareebjamal]

This is a parent issue describing some invalid queries generated from frontend which raise errors on the server

These issues should be fixed on priority. What's stranger is that all URLs are http, not https (maybe because being terminated by cloudflare)

Secondly, all of the URLs are from unauthenticated users

Only '=', '!=', 'is_()', 'isnot()', 'is_distinct_from()', 'isnot_distinct_from()' operators can be used with None/True/False

1. http://api.eventyay.com/v1/events/1107/attendees?fields%5Bevent%5D=id&fields%5Bticket%5D=id&filter=%5B%7B%22name%22%3A%22pdf-url%22%2C%22op%22%3A%22ilike%22%2C%22val%22%3Anull%7D%5D&include=order%2Cticket%2Cevent&page%5Bnumber%5D=1&page%5Bsize%5D=20

param	value
fields[event]	id
fields[ticket]	id
filter	[{"name":"pdf-url","op":"ilike","val":null}]
include	order,ticket,event
page[number]	1
page[size]	20

2. http://api.eventyay.com/v1/events/1107/attendees?fields%5Bevent%5D=id&fields%5Bticket%5D=id&filter=%5B%7B%22name%22%3A%22pdf-url%22%2C%22op%22%3A%22ge%22%2C%22val%22%3Anull%7D%5D&include=order%2Cticket%2Cevent&page%5Bnumber%5D=1&page%5Bsize%5D=20

param	value
fields[event]	id
fields[ticket]	id
filter	[{"name":"pdf-url","op":"ge","val":null}]
include	order,ticket,event
page[number]	1
page[size]	20

3. http://api.eventyay.com/v1/events/1107/attendees?fields%5Bevent%5D=id&fields%5Bticket%5D=id&filter=%5B%7B%22name%22%3A%22pdf-url%22%2C%22op%22%3A%22notilike%22%2C%22val%22%3Anull%7D%5D&include=order%2Cticket%2Cevent&page%5Bnumber%5D=1&page%5Bsize%5D=20

param	value
fields[event]	id
fields[ticket]	id
filter	[{"name":"pdf-url","op":"notilike","val":null}]
include	order,ticket,event
page[number]	1
page[size]	20

4. http://api.eventyay.com/v1/events/1107/attendees?fields%5Bevent%5D=id&fields%5Bticket%5D=id&filter=%5B%7B%22name%22%3A%22ticket%22%2C%22op%22%3A%22in%22%2C%22val%22%3A%22completed%22%7D%5D&include=order%2Cticket%2Cevent&page%5Bnumber%5D=1&page%5Bsize%5D=20

NotImplementedError: in_() not yet supported for relationships.  For a simple many-to-one, use in_() against the set of foreign key values.

param	value
fields[event]	id
fields[ticket]	id
filter	[{"name":"ticket","op":"in","val":"completed"}]
include	order,ticket,event
page[number]	1
page[size]	20

5. http://api.eventyay.com/v1/events/1107/attendees?fields%5Bevent%5D=id&fields%5Border%5D=amount&fields%5Bticket%5D=id&include=order%2Cticket%2Cevent&page%5Bnumber%5D=1&page%5Bsize%5D=20

AttributeError: 'identifier' is not a valid attribute of {'id': '11601', 'amount': 0.0}

param	value
fields[event]	id
fields[order]	amount
fields[ticket]	id
include	order,ticket,event
page[number]	1
page[size]	20

6. http://api.eventyay.com/v1/events/1107/attendees?fields%5Bevent%5D=id&fields%5Bticket%5D=id&filter=%5B%7B%22name%22%3A%22pdf-url%22%2C%22op%22%3A%22any%22%2C%22val%22%3Anull%7D%5D&include=order%2Cticket%2Cevent&page%5Bnumber%5D=1&page%5Bsize%5D=20

'Comparator' object has no attribute 'any'

variable	value
key	'any'
self	Column('pdf_url', String(), table=<ticket_holders>)

param	value
fields[event]	id
fields[ticket]	id
filter	[{"name":"pdf-url","op":"any","val":null}]
include	order,ticket,event
page[number]	1
page[size]	20

7. http://api.eventyay.com/v1/events/1107/attendees?fields%5Bevent%5D=id&fields%5Bticket%5D=id&filter=%5B%7B%22name%22%3A%22pdf-url%22%2C%22op%22%3A%22has%22%2C%22val%22%3Anull%7D%5D&include=order%2Cticket%2Cevent&page%5Bnumber%5D=1&page%5Bsize%5D=20

AttributeError: 'Comparator' object has no attribute 'has'

variable	value
key	'has'
self	Column('pdf_url', String(), table=<ticket_holders>)

param	value
fields[event]	id
fields[ticket]	id
filter	[{"name":"pdf-url","op":"has","val":null}]
include	order,ticket,event
page[number]	1
page[size]	20

All errors are from this event - https://eventyay.com/e/1e398689

[kushthedude]

@iamareebjamal Is it just me or the event doesn't have ticket price and ticket quantity` ?

[iamareebjamal]

For more magic. click on owner. And a wild ticket magically appears

Then click on Getting Here, another one, voila!

[kushthedude]

Yes , a VVIP ticket appears. Seems like the JS validations are useless as you said.

…

On Tue, 15 Oct, 2019, 16:35 Areeb Jamal, ***@***.***> wrote: For more magic. click on owner. And a wild ticket magically appears — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#3555?email_source=notifications&email_token=AKQMTLTTYQCX46BEKORLXI3QOWPWXA5CNFSM4JA2EOD2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEBILEGQ#issuecomment-542159386>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKQMTLT2AHTNUQPEJYOI2G3QOWPWXANCNFSM4JA2EODQ> .

[kushthedude]

So the following issue is due to the Unability of rendering of Currency Symbol

[kushthedude]

A hot fix for this can be to render Currency Code at place of Currency Symbol until we have not tested all the symbols ?
@iamareebjamal Your views

[iamareebjamal]

That is another issue than the failures I have listed in the first comment. Open another issue and send a PR for same.

The operation errors listed in the issue will not be solved by it

[mariobehling]

We will not have these issues on the next version. Therefore closing it.