fix(submission): handle missing xml file with digest authentication DEV-1038 #6428
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
noliveleger
requested changes
Oct 31, 2025
Contributor
noliveleger
left a comment
noliveleger
left a comment
There was a problem hiding this comment.
Please add unit tests
rajpatel24
requested review from
Akuukis,
Guitlle,
jamesrkiger,
magicznyleszek,
olive-KTB,
p2edwards and
rgraber
as code owners
rajpatel24
changed the base branch from
release/2.025.37
to
release/2.025.43
rajpatel24
requested review from
noliveleger
and removed request for
Akuukis,
Guitlle,
jamesrkiger,
magicznyleszek,
olive-KTB,
p2edwards and
rgraber
noliveleger
requested changes
Nov 21, 2025
| ) | ||
| with open(submission_path) as sf: | ||
| data = {'xml_submission_file': sf} | ||
| request = self.factory.post(f'/{username}/submission', data={}) |
Contributor
There was a problem hiding this comment.
Since you don't pass data here, could you move it in the next block, maybe sf.seek(0) would not be needed at this point?
| auth = DigestAuth('bob', 'bobbob') | ||
| request.META.update(auth(request.META, response)) | ||
| response = self.view(request, username=username) | ||
| self.assertContains(response, 'Successful submission', status_code=201) |
Contributor
There was a problem hiding this comment.
let's use status.HTTP_201_CREATED instead
This was referenced Nov 25, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🗒️ Checklist
#Support Docs Updates, if any<type>(<scope>)<!>: <title> DEV-1234Front endand/orBack endorworkflow📣 Summary
Prevent server errors when clients using Digest authentication send empty submission requests to the openrosa
/<username>/submissionendpoint.📖 Description
Previously, when a client (such as curl using --digest) attempted to submit to
https://kobocat/<username>/submissionfor a form that does not allow anonymous submissions, the first unauthenticated request in the Digest handshake was accepted by the view.Because this initial request contained no body and no authentication header, the view attempted to read a
Nonefile instance, leading to:This caused a 500 error before the client’s second (authenticated) request could be processed.
This PR adds a validation to check whether
xml_fileis missing or empty. When this happens, the server now fails fast with a properOpenRosaResponseBadRequest (400)and a clear, informative error message.👀 Preview steps