`/follows.json` POST handler does not validate publisher

[jimchamp]

Problem

The /follows.json POST handler allows a authenticated patron (the subscriber) to follow or unfollow another patron (the publisher). The problem is that handler does not verify that the given publisher exists before writing that publisher to the follows table.

Reproducing the bug

1. Go to ...
2. Do ...

• Expected behavior:
• Actual behavior:

Context

• Browser (Chrome, Safari, Firefox, etc):
• OS (Windows, Mac, etc):
• Logged in (Y/N):
• Environment (prod, dev, local): prod

Breakdown

Update the /follows.json POST handler to check if there is an account associated with the given publisher before writing to the DB. If no such provider exists, return a 404.

Requirements Checklist

• POST handler does a look-up for the publisher's account before writing to the DB
• Handler returns 404 response when the publisher does not exist

Related files

/follows.json POST handler:

openlibrary/openlibrary/plugins/openlibrary/api.py

Lines 525 to 534 in ba05bb3

	def POST(self, key):
	i = web.input(publisher='', redir_url='', state='')
	user = accounts.get_current_user()
	if not user or user.key != key:
	raise web.seeother(f'/account/login?redir_url={i.redir_url}')
	username = user.key.split('/')[2]
	action = PubSub.subscribe if i.state == '0' else PubSub.unsubscribe
	action(username, i.publisher)
	raise web.seeother(i.redir_url)

Stakeholders

@mekarpeles
@ragipidavid

---

Instructions for Contributors

• Please run these commands to ensure your repository is up to date before creating a new branch to work on this issue and each time after pushing code to Github, because the pre-commit bot may add commits to your PRs upstream.