Server settings → Plugins: a mistake in the repository form answers 405 Method Not Allowed instead of the error #491

New issue

Closed

opened 2026-10-01 10:47:04 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-01 10:47:04 +00:00

Owner

Found on 2026-09-29 in a read-only review of postulo at 95348908d, reading the repository view and posting an invalid form in a test.

Checked again on 2026-10-01 against main at 0a5cad587: still present. The code is now at core/server_views.py:1279-1281 (PluginRepositoryView._save) and core/server_views.py:936 (PluginsView).

When the form for adding or editing a plugin repository does not validate, the view hands the POST to PluginsView, which has no post handler. Django answers 405 Method Not Allowed with an empty body, so the administrator sees a blank page instead of the error, and what they typed is gone.

Where: core/server_views.py:1278-1280 (PluginRepositoryView._save: return PluginsView.as_view()(request, repository_form=form)); core/server_views.py:935 (class PluginsView(ServerSectionMixin, TemplateView), GET only); tests/test_plugin_repositories.py:153-167.
What happens: posting action=add with public_key="not base64 at all" to server:plugin_repository logs Method Not Allowed (POST): /server/plugins/repositories/ and answers 405 with an empty body. The same happens for a bad URL or a duplicate name, and for action=save on an existing repository.
Why it matters: adding a repository means pasting a public key and an address, where a mistake is likely; the form's messages, which exist to say what was wrong, are never shown. test_a_key_that_is_not_a_key_is_refused asserts only that nothing was saved, so it passes against the 405.
Fix: render the plugins page directly: build the view with PluginsView(); view.setup(request) and return view.render_to_response(view.get_context_data(repository_form=form)), or give PluginsView a post that delegates to get. Answer 200 (or 422) with the page and the bound form.

Done when

tests/test_plugin_repositories.py::test_a_key_that_is_not_a_key_is_refused also asserts a 200 (or 422) whose body contains the form's error for the key; it fails today.

Found on 2026-09-29 in a read-only review of postulo at 95348908d, reading the repository view and posting an invalid form in a test. Checked again on 2026-10-01 against `main` at `0a5cad587`: still present. The code is now at `core/server_views.py:1279-1281` (`PluginRepositoryView._save`) and `core/server_views.py:936` (`PluginsView`). When the form for adding or editing a plugin repository does not validate, the view hands the POST to `PluginsView`, which has no `post` handler. Django answers `405 Method Not Allowed` with an empty body, so the administrator sees a blank page instead of the error, and what they typed is gone. - **Where:** `core/server_views.py:1278-1280` (`PluginRepositoryView._save`: `return PluginsView.as_view()(request, repository_form=form)`); `core/server_views.py:935` (`class PluginsView(ServerSectionMixin, TemplateView)`, GET only); `tests/test_plugin_repositories.py:153-167`. - **What happens:** posting `action=add` with `public_key="not base64 at all"` to `server:plugin_repository` logs `Method Not Allowed (POST): /server/plugins/repositories/` and answers `405` with an empty body. The same happens for a bad URL or a duplicate name, and for `action=save` on an existing repository. - **Why it matters:** adding a repository means pasting a public key and an address, where a mistake is likely; the form's messages, which exist to say what was wrong, are never shown. `test_a_key_that_is_not_a_key_is_refused` asserts only that nothing was saved, so it passes against the `405`. - **Fix:** render the plugins page directly: build the view with `PluginsView(); view.setup(request)` and return `view.render_to_response(view.get_context_data(repository_form=form))`, or give `PluginsView` a `post` that delegates to `get`. Answer `200` (or `422`) with the page and the bound form. ## Done when - `tests/test_plugin_repositories.py::test_a_key_that_is_not_a_key_is_refused` also asserts a `200` (or `422`) whose body contains the form's error for the key; it fails today.

tiagoagueda added this to the 0.5.0 milestone

2026-10-01 10:47:04 +00:00

tiagoagueda added the

tier

bug

labels

2026-10-01 10:47:04 +00:00

tiagoagueda referenced this issue from a commit

2026-10-03 14:49:35 +00:00

Show the repository form's errors instead of a 405

tiagoagueda closed this issue

2026-10-03 14:49:35 +00:00