AttributeError: 'list' object has no attribute 'strip'

[Ryan J Ollos]

From the logs:

2016-04-09 09:32:23,823 Trac[main] ERROR: Internal Server Error: <RequestWithSession "GET '/register?__FORM_TOKEN=3e85b91934f824c6fd15affc&action=create&username=RochelleKirkpatr&password=dRJIKJ12&password_confirm=dRJIKJ12&email=evelinxkosanovicqjiy%40yahoo.com&basic_token=I%27m%20no%20bot%2C%20let%20me%20in%2C%20please.&sentinel=&name=Rochelle%20Kirkpatrick&spf_homepage=http%3A%2F%2Fwww.dailymotion.com%2Fvideo%2Fx37cm2j&sfp_email=&sfph_mail=&__FORM_TOKEN=747877c2cff29be086a7279c&action=create&username=RochelleKirkpatr&password=dRJIKJ12&password_confirm=dRJIKJ12&email=evelinxkosanovicqjiy%40yahoo.com&basic_token=I%27m%20no%20bot%2C%20let%20me%20in%2C%20please.&sentinel=&name=RochelleKirkpatr&spf_homepage=http%3A%2F%2Fwww.dailymotion.com%2Fvideo%2Fx37cm2j&sfp_email=&sfph_mail='">, referrer 'http://trac-hacks.org/register?__FORM_TOKEN=3e85b91934f824c6fd15affc&action=create&username=RochelleKirkpatr&password=dRJIKJ12&password_confirm=dRJIKJ12&email=evelinxkosanovicqjiy%40yahoo.com&basic_token=I%27m%20no%20bot%2C%20let%20me%20in%2C%20please.&sentinel=&name=Rochelle%20Kirkpatrick&spf_homepage=http%3A%2F%2Fwww.dailymotion.com%2Fvideo%2Fx37cm2j&sfp_email=&sfph_mail=&__FORM_TOKEN=747877c2cff29be086a7279c&action=create&username=RochelleKirkpatr&password=dRJIKJ12&password_confirm=dRJIKJ12&email=evelinxkosanovicqjiy%40yahoo.com&basic_token=I%27m%20no%20bot%2C%20let%20me%20in%2C%20please.&sentinel=&name=RochelleKirkpatr&spf_homepage=http%3A%2F%2Fwww.dailymotion.com%2Fvideo%2Fx37cm2j&sfp_email=&sfph_mail='
Traceback (most recent call last):
  File "/srv/trac-hacks.org/pve/lib/python2.7/site-packages/trac/web/main.py", line 554, in _dispatch_request
    dispatcher.dispatch(req)
  File "/srv/trac-hacks.org/pve/lib/python2.7/site-packages/trac/web/main.py", line 247, in dispatch
    resp = chosen_handler.process_request(req)
  File "/srv/trac-hacks.org/pve/lib/python2.7/site-packages/acct_mgr/register.py", line 430, in process_request
    name = req.args.get('name', '').strip()
AttributeError: 'list' object has no attribute 'strip'

[Ryan J Ollos]

I considered using getfirst, as in ​trac:#12349, however since this is the registration page perhaps we are better off just raising an HTTPBadRequest. That may stop more spam registration attempts before they can be submitted.

acct_mgr/register.py

@@ -20 +20 @@
 from trac.core import Component, TracError, implements
 from trac.config import BoolOption, Option
 from trac.web import auth, chrome
+from trac.web.api import HTTPBadRequest
 from trac.web.main import IRequestHandler, IRequestFilter
 
 from acct_mgr.api import AccountManager, CommonTemplateProvider
@@ -425 +426 @@
         if req.authname != 'anonymous':
             req.redirect(req.href.prefs('account'))
         action = req.args.get('action')
-        name = req.args.get('name', '').strip()
-        username = acctmgr.handle_username_casing(req.args.get('username',
-                                                               '').strip())
+        name = req.args.get('name', '')
+        if isinstance(name, list):
+            raise HTTPBadRequest(_("Invalid request arguments."))
+        name = name.strip()
+        username = req.args.get('username', '')
+        if isinstance(username, list):
+            raise HTTPBadRequest(_("Invalid request arguments."))
+        username = acctmgr.handle_username_casing(username.strip())
         data = {
             '_dgettext': dgettext,
             'acctmgr': {'name': name, 'username': username},

[Ryan J Ollos]

In 15481:

0.5dev: Raise HTTPBadRequest for list arguments in request

Fixes #12734.