Allow throwing exceptions for HTTP error codes to better check query param input. (#14023)

* Allow throwing exceptions for HTTP error codes to better check query param input.

* Add multiple period checks to visualizations.

* Forgot to add files.

* apply review comments

* Make sure code is set when using HttpCodeException.

2 files changed, 37 insertions, 1 deletions

diff --git a/plugins/ScheduledReports/API.php b/plugins/ScheduledReports/API.php
index ab82b56b7e..7cdb0505a7 100644
--- a/plugins/ScheduledReports/API.php
+++ b/plugins/ScheduledReports/API.php
@@ -21,6 +21,7 @@ use Piwik\Filesystem;
 use Piwik\Http;
 use Piwik\Log;
 use Piwik\NoAccessException;
+use Piwik\Period;
 use Piwik\Piwik;
 use Piwik\Plugins\ImageGraph\ImageGraph;
 use Piwik\Plugins\LanguagesManager\LanguagesManager;
@@ -309,7 +310,7 @@ class API extends \Piwik\Plugin\API
      * @param string $date YYYY-MM-DD
      * @param bool|false|string $language If not passed, will use default language.
      * @param bool|false|int $outputType 1 = download report, 3 = output report in browser, 4 = return report content to caller, defaults to download
-     * @param bool|false|string $period Defaults to 'day'. If not specified, will default to the report's period set when creating the report
+     * @param bool|false|string $period If not specified, will default to the report's period set when creating the report
      * @param bool|false|string $reportFormat 'pdf', 'html' or any other format provided via the ScheduledReports.getReportFormats hook
      * @param bool|false|array $parameters array of parameters
      * @return array|void
@@ -345,6 +346,8 @@ class API extends \Piwik\Plugin\API
             $period = $report['period_param'];
         }
 
+        $this->checkSinglePeriod($period, $date);
+
         // override report format
         if (!empty($reportFormat)) {
             self::validateReportFormat($reportType, $reportFormat);
@@ -1032,4 +1035,11 @@ class API extends \Piwik\Plugin\API
             throw new NoAccessException(Piwik::translate('General_ExceptionPrivilege', array("'view'")));
         }
     }
+
+    private function checkSinglePeriod($period, $date)
+    {
+        if (Period::isMultiplePeriod($date, $period)) {
+            throw new Http\BadRequestException("This API method does not support multiple periods.");
+        }
+    }
 }
diff --git a/plugins/ScheduledReports/tests/Integration/ApiTest.php b/plugins/ScheduledReports/tests/Integration/ApiTest.php
index 247b2136da..e445d99270 100644
--- a/plugins/ScheduledReports/tests/Integration/ApiTest.php
+++ b/plugins/ScheduledReports/tests/Integration/ApiTest.php
@@ -12,6 +12,7 @@ use Piwik\API\Proxy;
 use Piwik\Container\StaticContainer;
 use Piwik\DataTable;
 use Piwik\Date;
+use Piwik\Http\BadRequestException;
 use Piwik\Plugins\MobileMessaging\API as APIMobileMessaging;
 use Piwik\Plugins\MobileMessaging\MobileMessaging;
 use Piwik\Plugins\ScheduledReports\API as APIScheduledReports;
@@ -490,6 +491,31 @@ class ApiTest extends IntegrationTestCase
     }
 
     /**
+     * @expectedException \Piwik\Http\BadRequestException
+     * @expectedExceptionMessage This API method does not support multiple periods.
+     */
+    public function test_generateReport_throwsIfMultiplePeriodsRequested()
+    {
+        $idReport = APIScheduledReports::getInstance()->addReport(
+            1,
+            '',
+            Schedule::PERIOD_DAY,
+            0,
+            ScheduledReports::EMAIL_TYPE,
+            ReportRenderer::HTML_FORMAT,
+            array(
+                'VisitsSummary_get',
+                'UserCountry_getCountry',
+                'Referrers_getWebsites',
+            ),
+            array(ScheduledReports::DISPLAY_FORMAT_PARAMETER => ScheduledReports::DISPLAY_FORMAT_TABLES_ONLY)
+        );
+
+        APIScheduledReports::getInstance()->generateReport($idReport, '2012-03-03,2012-03-23',
+            $language = false, $outputType = APIScheduledReports::OUTPUT_RETURN);
+    }
+
+    /**
      * @expectedException \Exception
      * @expectedExceptionMessage Invalid evolutionPeriodFor value
      */