Validation when posting packages and tickets doesn't check if person or location exists for CreatedByPersonID or CreatedAtLocationID
- Dominant language
- C#
- Stars
- 1
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
Issue in PackageController.cs
calls:
PostPackage(PackageRequestModel request)
request:
{
"sender": "string",
"receiverId": "string",
"name": "string",
"collectionPointId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"createdByPersonId": "some invalid ID",
"createdAtLocationId": "some invalid ID"
}
PostTicket(TicketRequestModel request)
request:
{
"locationId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"completedByPersonId": "1",
"packageId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"receivedByPersonId": "some invalid id"
}
should be:
validation error
actual:
call goes through as normal despite the invalid ID in the request
quality tip:
check through the validation methods in the packagecontroller and see how you can make the error handling more verbose and worded correctly.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.