From 1be4df77ac5d04b2e06d4ee861818d975d64f14c Mon Sep 17 00:00:00 2001 From: Simon Willison Date: Tue, 8 Sep 2026 21:16:35 -0700 Subject: [PATCH] Reject invalid token expiry input --- datasette/views/special.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/datasette/views/special.py b/datasette/views/special.py index d3ccbebc..73b40b17 100644 --- a/datasette/views/special.py +++ b/datasette/views/special.py @@ -874,6 +874,11 @@ class CreateTokenView(BaseView): else: errors.append("Invalid expire duration unit") + if errors: + context = await self.shared(request) + context["errors"] = errors + return await self.render(["create_token.html"], request, context) + # Are there any restrictions? from datasette.tokens import TokenRestrictions