wuvt / wuvt-site

Website including a CMS, playlist information, and donation management tools
https://www.wuvt.vt.edu
GNU Affero General Public License v3.0
11 stars 12 forks source link

Sanitize donor phone numbers #360

Closed g-i-g closed 4 years ago

g-i-g commented 4 years ago

Historically, we've had improper phone numbers ("improper" meaning any number string that contained any special characters except for -) throw exceptions on donation since the Postgres database expects VARCHAR(12). This commit fixes that by reducing any given input down to just numbers.

echarlie commented 4 years ago

looks good, but we also ensure phone numbers are at most 12 digits before passing to the DB (i.e. +1 (540) 231-9888 -> 15402319888; I believe country codes are at most 3 digits but we really should only ever see +1 anyway), and are one of 5 (1-9888), 7 (231-9888), or >=9 ((540) 231-9888) digits long.

(If you wanted to be a real stickler, you could also raise an alert if those failed, and ensure 5-digit VT extensions always start with 1 or 2)

g-i-g commented 4 years ago

@echarlie I've added a length check in commit feffc2c. I think just checking to see if it exceeds 12 is satisfactory.

mutantmonkey commented 4 years ago

I agree that we should check for minimum length too, but let's just go ahead and get this fix in now.