From 5467678a2e139a0557ca17e486b8049a334585c7 Mon Sep 17 00:00:00 2001 From: Tim Abbott Date: Thu, 15 Nov 2012 11:29:32 -0500 Subject: [PATCH] send_message_backend: Return error on messages with no recipients. (imported from commit 4cf9bac8eb6e35dde0510afe4efb8ba70c86b566) --- zephyr/views.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/zephyr/views.py b/zephyr/views.py index 4e15dec7ea..d01c6037b3 100644 --- a/zephyr/views.py +++ b/zephyr/views.py @@ -511,6 +511,9 @@ def send_message_backend(request, user_profile, client_name, if forged and not is_super_user: return json_error("User not authorized for this query") + if len(message_to) == 0: + return json_error("Message must have recipients.") + if client_name == "zephyr_mirror": # Here's how security works for non-superuser mirroring: # @@ -539,7 +542,7 @@ def send_message_backend(request, user_profile, client_name, if message_type_name == 'stream': if "subject" not in request.POST: return json_error("Missing subject") - if len(message_to) != 1: + if len(message_to) > 1: return json_error("Cannot send to multiple streams") stream_name = message_to[0].strip() subject_name = request.POST['subject'].strip()