ulsdevteam / lcsu

0 stars 0 forks source link

Sanity checking posted data #3

Closed ctgraham closed 5 years ago

ctgraham commented 5 years ago

There is no logic here to ensure that the book is being scanned into an in-process tray.

https://github.com/ulsdevteam/lcsu/blob/fd1e3dc5a1307831f0275fafc29c4aa746a60f90/src/Controller/BooksController.php#L123-L125

Without this, someone could deliberately or mistakenly form a query which could scan a book into an already exported tray.

ctgraham commented 5 years ago

Possibly relatedly, if an input is expected and, null is documented and default: https://github.com/ulsdevteam/lcsu/blob/fd1e3dc5a1307831f0275fafc29c4aa746a60f90/src/Controller/ShelvesController.php#L139-L148 https://github.com/ulsdevteam/lcsu/blob/fd1e3dc5a1307831f0275fafc29c4aa746a60f90/src/Controller/ShelvesController.php#L166-L172

The application should handle an error or raise an exception if invalid input is presented. https://github.com/ulsdevteam/lcsu/blob/fd1e3dc5a1307831f0275fafc29c4aa746a60f90/src/Controller/ShelvesController.php#L123-L127

ctgraham commented 5 years ago

Resolved per: