Fixed validation of options in asignment polls

Also fixed #5334

openslides/assignments/projector.py

@@ -76,7 +76,9 @@ async def assignment_poll_slide(
             float(poll["amount_global_no"]) if poll["amount_global_no"] else None
         )
         poll_data["amount_global_abstain"] = (
-            float(poll["amount_global_abstain"]) if poll["amount_global_no"] else None
+            float(poll["amount_global_abstain"])
+            if poll["amount_global_abstain"]
+            else None
         )
         poll_data["votesvalid"] = float(poll["votesvalid"])
         poll_data["votesinvalid"] = float(poll["votesinvalid"])

openslides/assignments/views.py

@@ -407,13 +407,14 @@ class AssignmentPollViewSet(BasePollViewSet):
                 )
 
         else:
+            available_options = poll.get_options()
             if poll.pollmethod == AssignmentPoll.POLLMETHOD_VOTES:
                 if isinstance(data, dict):
                     amount_sum = 0
                     for option_id, amount in data.items():
                         if not is_int(option_id):
                             raise ValidationError({"detail": "Each id must be an int."})
-                        if not AssignmentOption.objects.filter(id=option_id).exists():
+                        if not available_options.filter(id=option_id).exists():
                             raise ValidationError(
                                 {"detail": f"Option {option_id} does not exist."}
                             )
@@ -458,7 +459,7 @@ class AssignmentPollViewSet(BasePollViewSet):
                 for option_id, value in data.items():
                     if not is_int(option_id):
                         raise ValidationError({"detail": "Keys must be int"})
-                    if not AssignmentOption.objects.filter(id=option_id).exists():
+                    if not available_options.filter(id=option_id).exists():
                         raise ValidationError(
                             {"detail": f"Option {option_id} does not exist."}
                         )
@@ -511,9 +512,7 @@ class AssignmentPollViewSet(BasePollViewSet):
 
         poll.voted.add(user)
 
-    def create_votes_type_named_pseudoanonymous(
+    def create_votes_types_yn_yna(self, data, poll, check_user, vote_user):
-        self, data, poll, check_user, vote_user
-    ):
         """
         check_user is used for the voted-array and weight of the vote,
         vote_user is the one put into the vote
@@ -545,7 +544,7 @@ class AssignmentPollViewSet(BasePollViewSet):
             AssignmentPoll.POLLMETHOD_YN,
             AssignmentPoll.POLLMETHOD_YNA,
         ):
-            self.create_votes_type_named_pseudoanonymous(data, poll, user, user)
+            self.create_votes_types_yn_yna(data, poll, user, user)
 
     def handle_pseudoanonymous_vote(self, data, poll, user):
         if poll.pollmethod == AssignmentPoll.POLLMETHOD_VOTES:
@@ -555,7 +554,7 @@ class AssignmentPollViewSet(BasePollViewSet):
             AssignmentPoll.POLLMETHOD_YN,
             AssignmentPoll.POLLMETHOD_YNA,
         ):
-            self.create_votes_type_named_pseudoanonymous(data, poll, user, None)
+            self.create_votes_types_yn_yna(data, poll, user, None)
 
     def convert_option_data(self, poll, data):
         poll_options = poll.get_options()

tests/integration/assignments/test_polls.py

@@ -1051,6 +1051,31 @@ class VoteAssignmentPollNamedYNA(VoteAssignmentPollBaseTestClass):
         vote = AssignmentVote.objects.get()
         self.assertEqual(vote.value, "Y")
 
+    def test_option_from_wrong_poll(self):
+        self.poll2 = self.create_poll()
+        self.poll2.create_options()
+        inform_changed_data(self.poll2)
+        # start both polls
+        self.poll.state = AssignmentPoll.STATE_STARTED
+        self.poll.save()
+        self.poll2.state = AssignmentPoll.STATE_STARTED
+        self.poll2.save()
+        option2 = self.poll2.options.get()
+        # Do request to poll with option2 (which is wrong...)
+        response = self.client.post(
+            reverse("assignmentpoll-vote", args=[self.poll.pk]), {str(option2.id): "Y"},
+        )
+        self.assertHttpStatusVerbose(response, status.HTTP_400_BAD_REQUEST)
+        self.assertEqual(AssignmentVote.objects.count(), 0)
+        option = self.poll.options.get()
+        option2 = self.poll2.options.get()
+        self.assertEqual(option.yes, Decimal("0"))
+        self.assertEqual(option.no, Decimal("0"))
+        self.assertEqual(option.abstain, Decimal("0"))
+        self.assertEqual(option2.yes, Decimal("0"))
+        self.assertEqual(option2.no, Decimal("0"))
+        self.assertEqual(option2.abstain, Decimal("0"))
+
     def test_too_many_options(self):
         self.start_poll()
         response = self.client.post(