Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

2016013233 #71

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Conversation

chenyijie2016
Copy link

No description provided.

@@ -1,3 +1,7 @@
from django.contrib import admin
from wechat.models import *
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

不应使用*

@@ -1,3 +1,325 @@
from django.shortcuts import render
from django.contrib import auth
from django.utils import timezone
from codex.baseerror import *
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

尽量不要使用*

Copy link
Author

@chenyijie2016 chenyijie2016 Nov 16, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

下面几行也是类似情况

# else:
# raise ValidateError('Please login!')

#创建活动
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

创建活动未判断用户权限

# else:
# raise ValidateError('Please login!')

#删除活动
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

未校验权限

# else:
# raise ValidateError('Please login!')

#上传图像并保存到服务器
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

上传接口也没有权限控制

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

下面其他接口也有相同问题,在此不再重复

if t.status == Ticket.STATUS_VALID:
bookedTickets += 1
elif t.status == Ticket.STATUS_USED:
usedTickets += 1
Copy link
Author

@chenyijie2016 chenyijie2016 Nov 16, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

上面几行 可以直接使用QuerySet的count方法

if activity.remain_tickets == 0:
return self.reply_text('没有多的票了!请自行尝试劝退抢到票的朋友们~')
unique_id = uuid.uuid5(uuid.NAMESPACE_DNS,self.user.student_id + activity.name + str(currentTime))
Ticket.objects.create(student_id = self.user.student_id, unique_id = unique_id,
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这里没有考虑并发冲突的情况 并且判断条件为 activity.remain_tickets == 0 如果remain_tickets 被并发的修改为小于0的数,会导致之后可以无限抢票

activities = Activity.objects.filter(status = Activity.STATUS_PUBLISHED)
return activities

def get_tickets(self):
Copy link
Author

@chenyijie2016 chenyijie2016 Nov 16, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

下面这几次数据库操作可以合并为一次

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant