Don't transfer to attendees with a blank transfer code

magfest · Jan 17, 2025 · 16cf3e2 · 16cf3e2
1 parent c787dcc
commit 16cf3e2
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/uber/site_sections/preregistration.py b/uber/site_sections/preregistration.py
@@ -1625,9 +1625,14 @@ def complete_badge_transfer(self, session, id, code, message='', **params):
         if cherrypy.request.method != 'POST':
             raise HTTPRedirect('transfer_badge?id={}&message={}', id, "Please submit the form to transfer your badge.")
 
+        code = code.strip()
+
         old = session.attendee(id)
         if not old.is_transferable:
             raise HTTPRedirect('../landing/index?message={}', 'This badge is not transferable.')
+
+        if not code:
+            raise HTTPRedirect('transfer_badge?id={}&message={}', id, 'Please enter a transfer code.')
 
         transfer_badges = session.query(Attendee).filter(
             Attendee.normalized_transfer_code == RegistrationCode.normalize_code(code))