django / django/djangoproject.com
dashboard metric_json returns 500 for an out-of-range days parameter
- Dominant language
- Python
- Stars
- 2k
- Forks
- 1.1k
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 33
Description
## Description
`dashboard.views.metric_json` returns a 500 for a `days` value that `int()` accepts but a `timedelta` cannot represent.
```
GET /metric/new-tickets-week.json?days=3652059
GET /metric/new-tickets-week.json?days=999999999
GET /metric/new-tickets-week.json?days=-999999999
```
```
File "dashboard/views.py", line 60, in metric_json
start_date = datetime.datetime.now() - datetime.timedelta(days=daysback)
OverflowError: date value out of range
```
The parameter is already guarded, but only against parsing:
```python
try:
daysback = int(request.GET["days"])
except (TypeError, KeyError, ValueError):
daysback = 30
```
`int("3652059")` succeeds, so the guard passes it through and the failure happens further down, at the `timedelta`. Widening that `except` does not help — it is the wrong scope.
`?days=abc`, `?days=`, `?days=-5` and a missing parameter are all handled correctly today and return 200; only the out-of-range case gets through.
## Reproduced
Locally, against `main` at 9a4867cf, through the view itself:
```
days='30' -> HTTP 200
days='abc' -> HTTP 200
days='-5' -> HTTP 200
days='' -> HTTP 200
days='3652059' -> UNHANDLED OverflowError: date value out of range
days='999999999' -> UNHANDLED OverflowError: date value out of range
```
I have deliberately not sent any of these to dashboard.djangoproject.com — the code path is identical and a live request would only add noise to your error reporting.
## Suggested fix
Build the window inside the guard, so an unusable number is caught the same way an unparseable one already is, and fall back to the same 30-day default. Happy to open the PR.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at dashboard/views.py line 60 and reproduce the metric_json requests with the listed days values. Keep the existing behavior for missing, invalid, and negative values, while ensuring values that exceed timedelta's range return HTTP 200 using the same 30-day fallback rather than raising OverflowError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 85/100