don't allow bad filetypes to preview

app/main/views/send.py

@@ -294,6 +294,9 @@ def check_messages(service_id, template_type, upload_id):
 @login_required
 @user_has_permissions('send_texts', 'send_emails', 'send_letters')
 def check_messages_preview(service_id, template_type, upload_id, filetype):
+    if filetype not in ('pdf', 'png'):
+        abort(404)
+
     template = _check_messages(
         service_id, template_type, upload_id, letters_as_pdf=True
     )['template']

app/main/views/templates.py

@@ -88,6 +88,9 @@ def view_template(service_id, template_id):
 @login_required
 @user_has_permissions('view_activity', admin_override=True)
 def view_letter_template_preview(service_id, template_id, filetype):
+    if filetype not in ('pdf', 'png'):
+        abort(404)
+
     db_template = service_api_client.get_service_template(service_id, template_id)['data']
     return TemplatePreview.from_database_object(db_template, filetype)
 

tests/app/main/views/test_send.py

@@ -577,6 +577,25 @@ def test_should_show_preview_letter_message(
     assert mocked_preview.call_args[0][1] == filetype
 
 
+def test_dont_show_preview_letter_templates_for_bad_filetype(
+    logged_in_client,
+    mock_get_service_template,
+    service_one,
+    fake_uuid
+):
+    resp = logged_in_client.get(
+        url_for(
+            'main.check_messages_preview',
+            service_id=service_one['id'],
+            template_type='letter',
+            upload_id=fake_uuid,
+            filetype='blah'
+        )
+    )
+    assert resp.status_code == 404
+    assert mock_get_service_template.called is False
+
+
 def test_check_messages_should_revalidate_file_when_uploading_file(
     logged_in_client,
     service_one,

tests/app/main/views/test_templates.py

@@ -185,6 +185,24 @@ def test_should_show_preview_letter_templates(
     assert mocked_preview.call_args[0][1] == filetype
 
 
+def test_dont_show_preview_letter_templates_for_bad_filetype(
+    logged_in_client,
+    mock_get_service_template,
+    service_one,
+    fake_uuid
+):
+    resp = logged_in_client.get(
+        url_for(
+            '.view_letter_template_preview',
+            service_id=service_one['id'],
+            template_id=fake_uuid,
+            filetype='blah'
+        )
+    )
+    assert resp.status_code == 404
+    assert mock_get_service_template.called is False
+
+
 def test_should_redirect_when_saving_a_template(
     logged_in_client,
     active_user_with_permissions,