[Python-checkins] r70540 - tracker/roundup-src/roundup/cgi/templating.py

[martin.v.loewis]

Author: martin.v.loewis
Date: Mon Mar 23 07:46:56 2009
New Revision: 70540

Log:
Validate property names for sorting.


Modified:
   tracker/roundup-src/roundup/cgi/templating.py

Modified: tracker/roundup-src/roundup/cgi/templating.py
==============================================================================
--- tracker/roundup-src/roundup/cgi/templating.py	(original)
+++ tracker/roundup-src/roundup/cgi/templating.py	Mon Mar 23 07:46:56 2009
@@ -2332,13 +2332,18 @@
                     dirs.append(self.form.getfirst(dirkey))
             if fields: # only try other special char if nothing found
                 break
+        cls = self.client.db.getclass(self.classname)
         for f, d in map(None, fields, dirs):
             if f.startswith('-'):
-                var.append(('-', f[1:]))
+                dir, name = '-', f[1:]
             elif d:
-                var.append(('-', f))
+                dir, name = '-', f
             else:
-                var.append(('+', f))
+                dir, name = '+', f
+            if cls.get_transitive_prop(name) is None:
+                self.client.error_message.append("Unknown property "+name)
+            else:
+                var.append((dir, name))
 
     def _post_init(self):
         """ Set attributes based on self.form