From: Rohan Kanade <rohan.kanade@nttdata.com>
Date: Fri, 23 Aug 2013 10:15:12 +0000 (-0700)
Subject: Fix quota update validation for non-int types
X-Git-Url: https://review.fuel-infra.org/gitweb?a=commitdiff_plain;h=60a2bf977733f2570a22b58cf650e97dabddc7fd;p=openstack-build%2Fcinder-build.git

Fix quota update validation for non-int types

Fixes lp bug #1215301

Change-Id: I4bf813579c128844884138ba49f074f81f96790a
---

diff --git a/cinder/api/contrib/quotas.py b/cinder/api/contrib/quotas.py
index 81d51ce55..892861763 100644
--- a/cinder/api/contrib/quotas.py
+++ b/cinder/api/contrib/quotas.py
@@ -58,6 +58,10 @@ class QuotaSetsController(object):
         return dict(quota_set=result)
 
     def _validate_quota_limit(self, limit):
+        if not isinstance(limit, int):
+            msg = _("Quota limit must be specified as an integer value.")
+            raise webob.exc.HTTPBadRequest(explanation=msg)
+
         # NOTE: -1 is a flag value for unlimited
         if limit < -1:
             msg = _("Quota limit must be -1 or greater.")
@@ -89,8 +93,8 @@ class QuotaSetsController(object):
         project_id = id
         for key in body['quota_set'].keys():
             if key in QUOTAS:
+                self._validate_quota_limit(body['quota_set'][key])
                 value = int(body['quota_set'][key])
-                self._validate_quota_limit(value)
                 try:
                     db.quota_update(context, project_id, key, value)
                 except exception.ProjectQuotaNotFound:
diff --git a/cinder/tests/api/contrib/test_quotas.py b/cinder/tests/api/contrib/test_quotas.py
index 7bef4f241..549ec1223 100644
--- a/cinder/tests/api/contrib/test_quotas.py
+++ b/cinder/tests/api/contrib/test_quotas.py
@@ -86,6 +86,11 @@ class QuotaSetsControllerTest(test.TestCase):
         result = self.controller.update(self.req, 'foo', body)
         self.assertDictMatch(result, make_body(tenant_id=None))
 
+    def test_update_invalid_key_value(self):
+        body = {'quota_set': {'gigabytes': "should_be_int"}}
+        self.assertRaises(webob.exc.HTTPBadRequest, self.controller.update,
+                          self.req, 'foo', body)
+
     def test_update_bad_quota_limit(self):
         body = {'quota_set': {'gigabytes': -1000}}
         self.assertRaises(webob.exc.HTTPBadRequest, self.controller.update,