diff --git a/umap/tests/test_map_views.py b/umap/tests/test_map_views.py index 8f0ccae3..c99183b8 100644 --- a/umap/tests/test_map_views.py +++ b/umap/tests/test_map_views.py @@ -775,6 +775,15 @@ def test_oembed_no_url_map(client, map, datalayer): assert response.status_code == 404 +def test_oembed_unknown_url_map(client, map, datalayer): + map_url = f"http://testserver{map.get_absolute_url()}" + # We change to an unknown id prefix to keep URL structure. + map_url = map_url.replace("map_", "_111") + url = f"{reverse('map_oembed')}?url={map_url}" + response = client.get(url) + assert response.status_code == 404 + + def test_oembed_wrong_format_map(client, map, datalayer): url = ( f"{reverse('map_oembed')}" diff --git a/umap/views.py b/umap/views.py index 467cb36c..dc2e16bc 100644 --- a/umap/views.py +++ b/umap/views.py @@ -695,7 +695,7 @@ class MapOEmbed(View): if "slug" not in kwargs or "map_id" not in kwargs: raise Http404("Invalid URL path.") - map_ = Map.objects.get(id=kwargs["map_id"], slug=kwargs["slug"]) + map_ = get_object_or_404(Map, id=kwargs["map_id"]) if map_.share_status != Map.PUBLIC: raise PermissionDenied("This map is not public.")