Handle DjangoValidationError in RemoveSelection

arkindex/documents/api/elements.py

@@ -1480,6 +1480,10 @@ class ManageSelection(SelectionMixin, ListAPIView):
     def delete(self, request, *args, **kwargs):
         if request.data.get('id'):
             field = serializers.PrimaryKeyRelatedField(queryset=self.get_selection())
+            try:
+                UUID(request.data['id'])
+            except (ValueError, AttributeError):
+                raise ValidationError({'id': ['Not a valid UUID.']})
             element = field.to_internal_value(request.data['id'])
             request.user.selections.get(element=element).delete()
         elif request.data.get('corpus'):

arkindex/documents/tests/test_selection_api.py

@@ -189,6 +189,12 @@ class TestElementsAPI(FixtureAPITestCase):
         response = self.client.delete(reverse('api:elements-selection'), data={'id': self.page.id})
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
 
+    def test_delete_not_a_uuid(self):
+        self.client.force_login(self.user)
+        response = self.client.delete(reverse('api:elements-selection'), data={'id': {'id': self.page.id, 'type': 'page'}}, format='json')
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertEqual(response.json(), {'id': ['Not a valid UUID.']})
+
     @override_settings(ARKINDEX_FEATURES={'selection': False})
     def test_delete_no_selection(self):
         self.client.force_login(self.user)