API: ticket by ID: abort 404 if no ticket

2020-08-10 12:29:32 -04:00 · 2020-08-10 12:29:32 -04:00 · 9450ca6437
parent 79212efcc4
commit 9450ca6437
1 changed files with 2 additions and 0 deletions
--- a/todosrht/blueprints/api/tickets.py
+++ b/todosrht/blueprints/api/tickets.py
@ -301,6 +301,8 @@ def tracker_ticket_by_id_events_GET(username, tracker_name, ticket_id):
    if not tracker:
        abort(404)
    ticket, access = get_ticket(tracker, ticket_id, user=current_token.user)
+    if not ticket:
+        abort(404)
    if not TicketAccess.browse in access:
        abort(401)
    events = Event.query.filter(Event.ticket_id == ticket.id)