fix: don't allow setting an entity to another entity's version

Author: bradenmacdonald

src/openedx_content/applets/publishing/api.py

@@ -932,6 +932,15 @@ def set_draft_version(
         # block is bookkeeping in our DraftChangeLog.
         draft.version_id = publishable_entity_version_pk
 
+        # Validate the entity
+        if publishable_entity_version_pk is not None:
+            if draft.entity.id != PublishableEntityVersion.objects.only("entity_id").get(
+                pk=publishable_entity_version_pk
+            ).entity_id:
+                raise ValidationError(
+                    "Entity mismatch - the specified PublishableEntityVersion does not match the PublishableEntity"
+                )
+
         # Check to see if we're inside a context manager for an active
         # DraftChangeLog (i.e. what happens if the caller is using the public
         # bulk_draft_changes_for() API call), or if we have to make our own.

tests/openedx_content/applets/publishing/test_api.py

@@ -2440,7 +2440,7 @@ def test_set_draft_version_rejects_version_from_different_entity(self) -> None:
         # This should raise an error because version_b_v1 belongs to entity_b,
         # not entity_a. Without validation, this silently corrupts entity_a's
         # draft to point to entity_b's content.
-        with pytest.raises((ValidationError, ValueError)):
+        with pytest.raises(ValidationError, match="Entity mismatch"):
             publishing_api.set_draft_version(entity_a.id, version_b_v1.pk)
 
     def test_publish_from_drafts_rejects_cross_package_drafts(self) -> None: