Sep 19, 2018 · Aug 23, 2018 · Aug 24, 2018 · Aug 24, 2018 · Aug 24, 2018 · Aug 24, 2018
diff --git a/docs/usage.md b/docs/usage.md
diff --git a/example/tests/test_filters.py b/example/tests/test_filters.py
diff --git a/rest_framework_json_api/filters/__init__.py b/rest_framework_json_api/filters/__init__.py
diff --git a/rest_framework_json_api/filters/filter.py b/rest_framework_json_api/filters/filter.py
diff --git a/rest_framework_json_api/filters/queryvalidation.py b/rest_framework_json_api/filters/queryvalidation.py
Original file line number	Diff line number	Diff line change
Expand Up		@@ -177,8 +177,8 @@ for `GET http://127.0.0.1:8000/nopage-entries?filter[bad]=1`:
		}
		```

	#### `JSONAPIQueryValidationFilter`
	`JSONAPIQueryValidationFilter` validates query parameters to be one of the defined JSON:API query parameters
	#### `QueryValidationFilter`
	`QueryValidationFilter` validates query parameters to be one of the defined JSON:API query parameters
		(sort, include, filter, fields, page) and returns a `400 Bad Request`. If a non-matching query parameter
		is used. This can help the client identify misspelled query parameters, for example.

Expand Down Expand Up		@@ -216,7 +216,7 @@ from models import MyModel
		class MyViewset(ModelViewSet):
		queryset = MyModel.objects.all()
		serializer_class = MyModelSerializer
	filter_backends = (filters.JSONAPIQueryValidationFilter, filters.OrderingFilter,
	filter_backends = (filters.QueryValidationFilter, filters.OrderingFilter,
		django_filters.DjangoFilterBackend,)
		filterset_fields = {
		'id': ('exact', 'lt', 'gt', 'gte', 'lte', 'in'),
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -251,7 +251,7 @@ def test_filter_invalid_association_name(self):
		def test_filter_empty_association_name(self):
		"""
		test for filter with missing association name
	error texts are different depending on whether JSONAPIQueryValidationFilter is in use.
	error texts are different depending on whether QueryValidationFilter is in use.
		TODO: Just change the "invalid filter" to "invalid query parameter" in JSONAPIDjangoFilter?
n2ygk marked this conversation as resolved. Show resolved Hide resolved
		"""
		response = self.client.get(self.url, data={'filter[]': 'foobar'})
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -1,2 +1,2 @@
		from .sort import OrderingFilter # noqa: F401
	from .queryvalidation import JSONAPIQueryValidationFilter # noqa: F401
	from .queryvalidation import QueryValidationFilter # noqa: F401
Original file line number	Diff line number	Diff line change
Expand Up		@@ -44,7 +44,7 @@ class JSONAPIDjangoFilter(DjangoFilterBackend):
		search_param = api_settings.SEARCH_PARAM

		# Make this regex check for 'filter' as well as 'filter[...]'
	# Leave other incorrect usages of 'filter' to JSONAPIQueryValidationFilter.
	# Leave other incorrect usages of 'filter' to QueryValidationFilter.
		# See http://jsonapi.org/format/#document-member-names for allowed characters
		# and http://jsonapi.org/format/#document-member-names-reserved-characters for reserved
		# characters (for use in paths, lists or as delimiters).
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -4,7 +4,7 @@
		from rest_framework.filters import BaseFilterBackend


	class JSONAPIQueryValidationFilter(BaseFilterBackend):
	class QueryValidationFilter(BaseFilterBackend):
n2ygk marked this conversation as resolved. Show resolved Hide resolved
		"""
		A backend filter that performs strict validation of query parameters for
		jsonapi spec conformance and raises a 400 error if non-conforming usage is
Expand All		@@ -15,18 +15,18 @@ class JSONAPIQueryValidationFilter(BaseFilterBackend):
		requirement that they MUST contain contain at least one non a-z character (U+0061 to U+007A).
n2ygk marked this conversation as resolved. Show resolved Hide resolved
		It is RECOMMENDED that a U+002D HYPHEN-MINUS, "-", U+005F LOW LINE, "_", or capital letter is
		used (e.g. camelCasing)." -- http://jsonapi.org/format/#query-parameters

	TODO: For jsonapi error object conformance, must set jsonapi errors
	"parameter" for the ValidationError. This requires extending DRF/DJA Exceptions.
		"""
	# sort and include stand alone; filter, fields, page have []'s
	#: compiled regex that matches the allowed http://jsonapi.org/format/#query-parameters
	#: `sort` and `include` stand alone; `filter`, `fields`, and `page` have []'s
		query_regex = re.compile(r'^(sort\|include)$\|^(filter\|fields\|page)(\[[\w\.\-]+\])?$')

		def validate_query_params(self, request):
		"""
		Validate that query params are in the list of valid query keywords
		Raises ValidationError if not.
		"""
	# TODO: For jsonapi error object conformance, must set jsonapi errors "parameter" for
	# the ValidationError. This requires extending DRF/DJA Exceptions.
		for qp in request.query_params.keys():
		if not self.query_regex.match(qp):
		raise ValidationError('invalid query parameter: {}'.format(qp))
Expand Down