Task #10339: use json.loads for parsing incoming data

SAS/ResourceAssignment/ResourceAssignmentEditor/lib/webservice.py

@@ -29,6 +29,7 @@ from optparse import OptionParser
 from threading import Condition, Lock, current_thread, Thread
 import _strptime
 from datetime import datetime
+from json import loads as json_loads
 import time
 import logging
 import subprocess
@@ -371,11 +372,12 @@ def getTasksByMoMParentGroupId(mom_parent_group_id):
 def putTask(task_id):
     if 'Content-Type' in request.headers and \
             request.headers['Content-Type'].startswith('application/json'):
-        updatedTask = json.loads(request.data)
-
         try:
-            if task_id != updatedTask['id']:
-                abort(404)
+            updatedTask = json_loads(request.data)
+            logger.info('putTask: updatedTask: %s', updatedTask)
+
+            if task_id != int(updatedTask['id']):
+                abort(404, 'task_id in url is not equal to id in request.data')
 
             if 'starttime' in updatedTask:
                 if isProductionEnvironment():
@@ -395,7 +397,6 @@ def putTask(task_id):
                 except ValueError:
                     abort(400, 'timestamp not in iso format: ' + updatedTask['endtime'])
 
-            logger.info('putTask: ' + str(updatedTask))
             if 'status' in updatedTask:
                 task = radb().getTask(task_id)
 
@@ -433,8 +434,9 @@ def putTask(task_id):
                 curpc.setTaskDataPinned(task['otdb_id'], updatedTask['data_pinned'])
 
             return "", 204
-        except KeyError:
-            abort(404)
+        except Exception as e:
+            logger.error(e)
+            abort(404, str(e))
     abort(406)
 
 @app.route('/rest/tasks/<int:task_id>/cleanup', methods=['DELETE'])
@@ -443,7 +445,7 @@ def cleanupTaskData(task_id):
         delete_params = {}
 
         if 'Content-Type' in request.headers and (request.headers['Content-Type'].startswith('application/json') or request.headers['Content-Type'].startswith('text/plain')):
-            delete_params = json.loads(request.data)
+            delete_params = json_loads(request.data)
 
         task = radb().getTask(task_id)