diff --git a/contentcuration/contentcuration/viewsets/user.py b/contentcuration/contentcuration/viewsets/user.py index bbd2389ee5..a30b3f1bc6 100644 --- a/contentcuration/contentcuration/viewsets/user.py +++ b/contentcuration/contentcuration/viewsets/user.py @@ -1,3 +1,4 @@ +import uuid from functools import reduce from django.db import IntegrityError @@ -311,11 +312,17 @@ def remove_self(self, request, pk=None): if not channel_id: return HttpResponseBadRequest("Channel ID is required.") + try: + uuid.UUID(channel_id) + except ValueError: + return HttpResponseBadRequest("Invalid channel ID") try: channel = Channel.objects.get(id=channel_id) except Channel.DoesNotExist: return HttpResponseNotFound("Channel not found {}".format(channel_id)) + except ValueError: + return HttpResponseBadRequest("Invalid channel ID: {}".format(channel_id)) if request.user != user and not request.user.can_edit(channel_id): return HttpResponseForbidden(