From 766b0daf188ad22634d9a414e786544170ba8cd2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Laur=C3=A9line=20Gu=C3=A9rin?= <zebuline@entrouvert.com>
Date: Tue, 11 Jan 2022 14:31:24 +0100
Subject: [PATCH 2/4] backoffice: return nothing on unknown filter (#59224)

---
 tests/backoffice_pages/test_custom_view.py | 34 ++++++++++++++++++++
 tests/backoffice_pages/test_filters.py     | 36 ++++++++++++++++++++++
 wcs/backoffice/management.py               |  7 ++++-
 3 files changed, 76 insertions(+), 1 deletion(-)

diff --git a/tests/backoffice_pages/test_custom_view.py b/tests/backoffice_pages/test_custom_view.py
index 35b8c5ff..9e187fbc 100644
--- a/tests/backoffice_pages/test_custom_view.py
+++ b/tests/backoffice_pages/test_custom_view.py
@@ -133,6 +133,40 @@ def test_backoffice_custom_view(pub):
     assert 'Views must have at least one column.' in resp.text
 
 
+def test_backoffice_custom_view_unknown_filter(pub):
+    create_superuser(pub)
+
+    FormDef.wipe()
+    pub.custom_view_class.wipe()
+    formdef = FormDef()
+    formdef.name = 'form title'
+    formdef.fields = []
+    formdef.workflow_roles = {'_receiver': 1}
+    formdef.store()
+
+    formdef.data_class().wipe()
+    for i in range(10):
+        formdata = formdef.data_class()()
+        formdata.jump_status('new')
+        formdata.store()
+
+    app = login(get_app(pub))
+    resp = app.get('/backoffice/management/form-title/')
+    assert resp.text.count('<tr') == 10 + 1
+
+    custom_view = pub.custom_view_class()
+    custom_view.title = 'custom test view'
+    custom_view.formdef = formdef
+    custom_view.visibility = 'any'
+    custom_view.columns = {'list': [{'id': 'id'}]}
+    custom_view.filters = {'filter-42': 'on', 'filter-42-value': 'foo', 'filter-foobar': 'baz'}
+    custom_view.store()
+
+    resp = app.get('/backoffice/management/form-title/custom-test-view/')
+    assert resp.text.count('<tr') == 1
+    assert 'Invalid filters &quot;42&quot;, &quot;foobar&quot;' in resp
+
+
 def test_backoffice_custom_view_user_filter(pub):
     superuser = create_superuser(pub)
 
diff --git a/tests/backoffice_pages/test_filters.py b/tests/backoffice_pages/test_filters.py
index 392a49e1..cb5392d8 100644
--- a/tests/backoffice_pages/test_filters.py
+++ b/tests/backoffice_pages/test_filters.py
@@ -121,6 +121,42 @@ def test_backoffice_default_filter(pub):
     assert 'filter-4-value' in resp.forms['listing-settings'].fields
 
 
+def test_backoffice_unknown_filter(pub):
+    create_superuser(pub)
+
+    FormDef.wipe()
+    formdef = FormDef()
+    formdef.name = 'form-title'
+    formdef.fields = []
+    formdef.workflow_roles = {'_receiver': 1}
+    formdef.store()
+
+    data_class = formdef.data_class()
+    data_class.wipe()
+    for i in range(10):
+        formdata = data_class()
+        formdata.just_created()
+        formdata.jump_status('new')
+        formdata.store()
+
+    app = login(get_app(pub))
+    resp = app.get('/backoffice/management/form-title/')
+    assert resp.text.count('<tr') == 11
+    resp = app.get('/backoffice/management/form-title/?filter-foobar=42')
+    assert resp.text.count('<tr') == 1
+    assert 'Invalid filter &quot;foobar&quot;' in resp
+    resp = app.get('/backoffice/management/form-title/?filter-42=on&filter-42-value=foobar')
+    assert resp.text.count('<tr') == 1
+    assert 'Invalid filter &quot;42&quot;' in resp
+
+    resp = app.get('/backoffice/management/form-title/?filter-foobar=42&filter-baz=35')
+    assert resp.text.count('<tr') == 1
+    assert 'Invalid filters &quot;baz&quot;, &quot;foobar&quot;' in resp
+    resp = app.get('/backoffice/management/form-title/?filter-42=on&filter-42-value=foobar&filter-baz=35')
+    assert resp.text.count('<tr') == 1
+    assert 'Invalid filters &quot;42&quot;, &quot;baz&quot;' in resp
+
+
 def test_backoffice_bool_filter(pub):
     create_superuser(pub)
     create_environment(pub)
diff --git a/wcs/backoffice/management.py b/wcs/backoffice/management.py
index 7037120d..d050f837 100644
--- a/wcs/backoffice/management.py
+++ b/wcs/backoffice/management.py
@@ -1834,7 +1834,11 @@ class FormPage(Directory):
                 )
                 % {'filters': '", "'.join(f for f in unknown_filters)}
             )
-            raise RequestError(error_message)
+            if self.view_type == 'json':
+                raise RequestError(error_message)
+            if self.view_type == 'table':
+                get_session().message = ('warning', error_message)
+            criterias.append(Equal('status', '_none'))
 
         return criterias
 
@@ -2133,6 +2137,7 @@ class FormPage(Directory):
             return job.file_content
 
     def json(self):
+        self.view_type = 'json'
         anonymise = get_request().has_anonymised_data_api_restriction()
         self.check_access()
         get_response().set_content_type('application/json')
-- 
2.34.1

