Refs #1052 -- Added max_value validation to donations.

Stripe's API rejects very large values. Sentry reports folks enjoying spending
the weekend entering such large values. So reject as invalid, and show an
appropriate alert before attempting to contact Stripe.

2 files changed, 11 insertions, 0 deletions

diff --git a/fundraising/forms.py b/fundraising/forms.py
index 7e269cd2..b6c5970c 100644
--- a/fundraising/forms.py
+++ b/fundraising/forms.py
@@ -165,6 +165,7 @@ class PaymentForm(forms.Form):
     amount = forms.IntegerField(
         required=True,
         min_value=1,  # Minimum payment from Stripe API
+        max_value=1_000_000,  # Reject clearly unrealistic amounts.
     )
     interval = forms.ChoiceField(
         required=True,
diff --git a/fundraising/tests/test_forms.py b/fundraising/tests/test_forms.py
index d66d6b51..09744441 100644
--- a/fundraising/tests/test_forms.py
+++ b/fundraising/tests/test_forms.py
@@ -10,3 +10,13 @@ class TestPaymentForm(TestCase):
             'interval': 'onetime',
         })
         self.assertTrue(form.is_valid())
+
+    def test_max_value_validation(self):
+        """
+        Reject unrealistic values greater than $1,000,000.
+        """
+        form = PaymentForm(data={
+            'amount': 1_000_001,
+            'interval': 'onetime',
+        })
+        self.assertFalse(form.is_valid())