Skip to content

2016013233#71

Open
chenyijie2016 wants to merge 1 commit into
THUCampus:masterfrom
chenyijie2016:dev-alice
Open

2016013233#71
chenyijie2016 wants to merge 1 commit into
THUCampus:masterfrom
chenyijie2016:dev-alice

Conversation

@chenyijie2016
Copy link
Copy Markdown

No description provided.

Comment thread adminpage/admin.py
@@ -1,3 +1,7 @@
from django.contrib import admin
from wechat.models import *
Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

不应使用*

Comment thread adminpage/views.py
from django.shortcuts import render
from django.contrib import auth
from django.utils import timezone
from codex.baseerror import *
Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

尽量不要使用*

Copy link
Copy Markdown
Author

@chenyijie2016 chenyijie2016 Nov 16, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

下面几行也是类似情况

Comment thread adminpage/views.py
# else:
# raise ValidateError('Please login!')

#创建活动
Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

创建活动未判断用户权限

Comment thread adminpage/views.py
# else:
# raise ValidateError('Please login!')

#删除活动
Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

未校验权限

Comment thread adminpage/views.py
# else:
# raise ValidateError('Please login!')

#上传图像并保存到服务器
Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

上传接口也没有权限控制

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

下面其他接口也有相同问题,在此不再重复

Comment thread adminpage/views.py
if t.status == Ticket.STATUS_VALID:
bookedTickets += 1
elif t.status == Ticket.STATUS_USED:
usedTickets += 1
Copy link
Copy Markdown
Author

@chenyijie2016 chenyijie2016 Nov 16, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

上面几行 可以直接使用QuerySet的count方法

Comment thread wechat/handlers.py
if activity.remain_tickets == 0:
return self.reply_text('没有多的票了!请自行尝试劝退抢到票的朋友们~')
unique_id = uuid.uuid5(uuid.NAMESPACE_DNS,self.user.student_id + activity.name + str(currentTime))
Ticket.objects.create(student_id = self.user.student_id, unique_id = unique_id,
Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这里没有考虑并发冲突的情况 并且判断条件为 activity.remain_tickets == 0 如果remain_tickets 被并发的修改为小于0的数,会导致之后可以无限抢票

Comment thread wechat/wrapper.py
activities = Activity.objects.filter(status = Activity.STATUS_PUBLISHED)
return activities

def get_tickets(self):
Copy link
Copy Markdown
Author

@chenyijie2016 chenyijie2016 Nov 16, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

下面这几次数据库操作可以合并为一次

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant