From 00d7be5756e2fc19f8a79d046229d5b1a480f704 Mon Sep 17 00:00:00 2001 From: Chesta Date: Thu, 9 Jul 2026 12:30:01 +0530 Subject: [PATCH] Validate pagination parameters in campaign leads endpoint --- backend/campaigns/views.py | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/backend/campaigns/views.py b/backend/campaigns/views.py index 6d08640..a47a2c6 100644 --- a/backend/campaigns/views.py +++ b/backend/campaigns/views.py @@ -269,8 +269,17 @@ def leads(self, request, pk=None): """Get paginated list of enrolled leads with metrics.""" campaign = self.get_object() status_filter = request.query_params.get('status') - limit = int(request.query_params.get('limit', 50)) - offset = int(request.query_params.get('offset', 0)) + try: + limit = int(request.query_params.get("limit", 50)) + offset = int(request.query_params.get("offset", 0)) + except (TypeError, ValueError): + return Response( + {"error": "limit and offset must be integers."}, + status=status.HTTP_400_BAD_REQUEST, + ) + limit = max(1, min(limit, 200)) + + offset = max(0, offset) leads_qs = campaign.enrolled_leads.select_related('lead').order_by('-updated_at')