validate first (why even ...)

1 files changed, 2 insertions, 0 deletions

diff --git a/talerbank/app/views.py b/talerbank/app/views.py
index 40de3e6..60ee598 100644
--- a/talerbank/app/views.py
+++ b/talerbank/app/views.py
@@ -901,6 +901,8 @@ def add_incoming(request, user_account):
 def withdraw_headless_uri(request, user):
     data_json = json.loads(request.body.decode("utf-8"))
     data = WithdrawHeadlessUri(data_json)
+    if not data.is_valid():
+        raise JSONFieldException(data.errors, 400)
     user_account = BankAccount.objects.get(user=user)
     op = TalerWithdrawOperation(amount=data.amount, withdraw_account=user_account)
     op.save()