Fix: _validate_owner crashes on wrong-typed owner, not just missing id

Review caught that the previous fix only caught User.DoesNotExist,
but parameters is a bare DictField, so a list/dict/non-numeric-string
owner reaches User.objects.get(pk=owner) and raises an uncaught
TypeError/ValueError from Django's AutoField.get_prep_value instead.

docs/configuration.md

@@ -1209,14 +1209,6 @@ left unassigned, preventing low-confidence guesses from being applied.
 
     Defaults to 0.6.
 
-#### [`PAPERLESS_MATCH_REGEX_TIMEOUT_SECONDS=<float>`](#PAPERLESS_MATCH_REGEX_TIMEOUT_SECONDS) {#PAPERLESS_MATCH_REGEX_TIMEOUT_SECONDS}
-
-: Sets the timeout, in seconds, for regular expression matching. Increase this
-value if date parsing or user-defined matching rules time out when processing
-long documents, especially on slower hardware.
-
-    Defaults to 0.1 seconds.
-
 #### [`PAPERLESS_DATE_PARSER_LANGUAGES=<lang>`](#PAPERLESS_DATE_PARSER_LANGUAGES) {#PAPERLESS_DATE_PARSER_LANGUAGES}
 
 : Specifies which language Paperless should use when parsing dates from documents.

src/documents/bulk_edit.py

@@ -899,26 +899,17 @@ def edit_pdf(
     pdf_docs: list[pikepdf.Pdf] = []
 
     try:
-        if not operations:
-            raise ValueError("Output document index is out of bounds")
-
-        max_idx = max(op.get("doc", 0) for op in operations)
-        if update_document and max_idx > 0:
-            logger.error(
-                "Update requested but multiple output documents specified",
-            )
-            raise ValueError("Multiple output documents specified")
-
-        if any(
-            op.get("doc", 0) < 0 or op.get("doc", 0) >= len(operations)
-            for op in operations
-        ):
-            raise ValueError("Output document index is out of bounds")
-
         with pikepdf.open(pair.source_doc.source_path) as src:
             # prepare output documents
+            max_idx = max(op.get("doc", 0) for op in operations)
             pdf_docs = [pikepdf.new() for _ in range(max_idx + 1)]
 
+            if update_document and len(pdf_docs) > 1:
+                logger.error(
+                    "Update requested but multiple output documents specified",
+                )
+                raise ValueError("Multiple output documents specified")
+
             for op in operations:
                 dst = pdf_docs[op.get("doc", 0)]
                 page = src.pages[op["page"] - 1]

src/documents/serialisers.py

@@ -1750,7 +1750,7 @@ class MergeDocumentsAsVersionsSerializer(DocumentListSerializer):
 
 
 class EditPdfDocumentsSerializer(DocumentListSerializer, SourceModeValidationMixin):
-    operations = serializers.ListField(required=True, allow_empty=False)
+    operations = serializers.ListField(required=True)
     delete_original = serializers.BooleanField(required=False, default=False)
     update_document = serializers.BooleanField(required=False, default=False)
     include_metadata = serializers.BooleanField(required=False, default=True)
@@ -1788,12 +1788,6 @@ class EditPdfDocumentsSerializer(DocumentListSerializer, SourceModeValidationMix
                     "update_document only allowed with a single output document",
                 )
 
-        if any(
-            op.get("doc", 0) < 0 or op.get("doc", 0) >= len(operations)
-            for op in operations
-        ):
-            raise serializers.ValidationError("doc index is out of bounds")
-
         doc = Document.objects.get(id=documents[0])
         if doc.page_count:
             for op in operations:
@@ -2043,10 +2037,10 @@ class BulkEditSerializer(
             raise serializers.ValidationError("remove_custom_fields not specified")
 
     def _validate_owner(self, owner):
-        ownerUser = User.objects.get(pk=owner)
-        if ownerUser is None:
+        try:
+            return User.objects.get(pk=owner)
+        except (User.DoesNotExist, TypeError, ValueError):
             raise serializers.ValidationError("Specified owner cannot be found")
-        return ownerUser
 
     def _validate_parameters_set_permissions(self, parameters) -> None:
         if "set_permissions" not in parameters:
@@ -2066,7 +2060,7 @@ class BulkEditSerializer(
                 or not float(parameters["degrees"]).is_integer()
             ):
                 raise serializers.ValidationError("invalid rotation degrees")
-        except ValueError:
+        except (TypeError, ValueError):
             raise serializers.ValidationError("invalid rotation degrees")
 
     def _validate_source_mode(self, parameters) -> None:
@@ -2079,6 +2073,8 @@ class BulkEditSerializer(
     def _validate_parameters_split(self, parameters) -> None:
         if "pages" not in parameters:
             raise serializers.ValidationError("pages not specified")
+        if not isinstance(parameters["pages"], str):
+            raise serializers.ValidationError("invalid pages specified")
         try:
             pages = []
             docs = parameters["pages"].split(",")
@@ -2130,8 +2126,6 @@ class BulkEditSerializer(
             raise serializers.ValidationError("operations not specified")
         if not isinstance(parameters["operations"], list):
             raise serializers.ValidationError("operations must be a list")
-        if not parameters["operations"]:
-            raise serializers.ValidationError("operations must not be empty")
         for op in parameters["operations"]:
             if not isinstance(op, dict):
                 raise serializers.ValidationError("invalid operation entry")
@@ -2159,12 +2153,6 @@ class BulkEditSerializer(
                     "update_document only allowed with a single output document",
                 )
 
-        if any(
-            op.get("doc", 0) < 0 or op.get("doc", 0) >= len(parameters["operations"])
-            for op in parameters["operations"]
-        ):
-            raise serializers.ValidationError("doc index is out of bounds")
-
         doc = Document.objects.get(id=document_id)
         # doc existence is already validated
         if doc.page_count:

src/documents/tests/test_api_bulk_edit.py

@@ -1165,6 +1165,65 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
         self.assertIn(b"set_permissions not specified", response.content)
         m.assert_not_called()
 
+    @mock.patch("documents.serialisers.bulk_edit.set_permissions")
+    def test_set_permissions_rejects_nonexistent_owner(self, m) -> None:
+        """
+        BulkEditSerializer._validate_owner called User.objects.get(pk=owner)
+        with no try/except, so a syntactically valid but nonexistent user
+        id raised an uncaught User.DoesNotExist instead of a clean 400.
+        """
+        self.setup_mock(m, "set_permissions")
+
+        response = self.client.post(
+            "/api/documents/bulk_edit/",
+            json.dumps(
+                {
+                    "documents": [self.doc2.id],
+                    "method": "set_permissions",
+                    "parameters": {
+                        "set_permissions": {"view": {"users": [self.user.id]}},
+                        "owner": 999999,
+                    },
+                },
+            ),
+            content_type="application/json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        m.assert_not_called()
+
+    @mock.patch("documents.serialisers.bulk_edit.set_permissions")
+    def test_set_permissions_rejects_wrong_typed_owner(self, m) -> None:
+        """
+        _validate_owner only caught User.DoesNotExist -- a wrong-typed
+        owner (list/dict/non-numeric string) reaches
+        User.objects.get(pk=owner) and raises an uncaught TypeError or
+        ValueError instead, since `parameters` is a bare DictField with
+        no type checking on "owner" at that level.
+        """
+        self.setup_mock(m, "set_permissions")
+
+        for bad_owner in (["not", "an", "id"], {"nested": "dict"}, "not-a-number"):
+            with self.subTest(owner=bad_owner):
+                response = self.client.post(
+                    "/api/documents/bulk_edit/",
+                    json.dumps(
+                        {
+                            "documents": [self.doc2.id],
+                            "method": "set_permissions",
+                            "parameters": {
+                                "set_permissions": {
+                                    "view": {"users": [self.user.id]},
+                                },
+                                "owner": bad_owner,
+                            },
+                        },
+                    ),
+                    content_type="application/json",
+                )
+                self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        m.assert_not_called()
+
     @mock.patch("documents.serialisers.bulk_edit.set_permissions")
     def test_set_permissions_merge(self, m) -> None:
         self.setup_mock(m, "set_permissions")
@@ -1438,6 +1497,53 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
         m.assert_not_called()
 
+    @mock.patch("documents.serialisers.bulk_edit.rotate")
+    def test_bulk_edit_rotate_rejects_null_degrees(self, m) -> None:
+        """
+        BulkEditSerializer._validate_parameters_rotate's
+        `float(parameters["degrees"])` raised an uncaught TypeError for
+        None (only ValueError was caught), reachable via the legacy
+        generic /api/documents/bulk_edit/ method="rotate" path (the
+        dedicated /api/documents/rotate/ endpoint isn't affected, its
+        `degrees` field is a typed IntegerField).
+        """
+        self.setup_mock(m, "rotate")
+        response = self.client.post(
+            "/api/documents/bulk_edit/",
+            json.dumps(
+                {
+                    "documents": [self.doc2.id],
+                    "method": "rotate",
+                    "parameters": {"degrees": None},
+                },
+            ),
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        m.assert_not_called()
+
+    @mock.patch("documents.serialisers.bulk_edit.split")
+    def test_bulk_edit_split_rejects_null_pages(self, m) -> None:
+        """
+        BulkEditSerializer._validate_parameters_split called
+        parameters["pages"].split(",") with no type check, so a null
+        value raised an uncaught AttributeError instead of a clean 400.
+        """
+        self.setup_mock(m, "split")
+        response = self.client.post(
+            "/api/documents/bulk_edit/",
+            json.dumps(
+                {
+                    "documents": [self.doc2.id],
+                    "method": "split",
+                    "parameters": {"pages": None},
+                },
+            ),
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        m.assert_not_called()
+
     @mock.patch("documents.views.bulk_edit.rotate")
     def test_rotate_insufficient_permissions(self, m) -> None:
         self.doc1.owner = User.objects.get(username="temp_admin")
@@ -1649,40 +1755,6 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
 
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
 
-    def test_legacy_bulk_edit_rejects_out_of_bounds_pdf_doc_index(self) -> None:
-        response = self.client.post(
-            "/api/documents/bulk_edit/",
-            json.dumps(
-                {
-                    "documents": [self.doc2.id],
-                    "method": "edit_pdf",
-                    "parameters": {
-                        "operations": [{"page": 1, "doc": 2**32}],
-                    },
-                },
-            ),
-            content_type="application/json",
-        )
-
-        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
-        self.assertIn(b"doc index is out of bounds", response.content)
-
-    def test_legacy_bulk_edit_rejects_empty_pdf_operations(self) -> None:
-        response = self.client.post(
-            "/api/documents/bulk_edit/",
-            json.dumps(
-                {
-                    "documents": [self.doc2.id],
-                    "method": "edit_pdf",
-                    "parameters": {"operations": []},
-                },
-            ),
-            content_type="application/json",
-        )
-
-        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
-        self.assertIn(b"operations must not be empty", response.content)
-
     @mock.patch("documents.views.bulk_edit.edit_pdf")
     def test_edit_pdf(self, m) -> None:
         self.setup_mock(m, "edit_pdf")
@@ -1733,13 +1805,6 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
         self.assertIn(b"Expected a list of items", response.content)
 
-        response = self.client.post(
-            "/api/documents/edit_pdf/",
-            {"documents": [self.doc2.id], "operations": []},
-            format="json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
-
         response = self.client.post(
             "/api/documents/edit_pdf/",
             json.dumps(
@@ -1792,21 +1857,6 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
         self.assertIn(b"doc must be an integer", response.content)
 
-        for doc_index in (-1, 2**32):
-            with self.subTest(doc_index=doc_index):
-                response = self.client.post(
-                    "/api/documents/edit_pdf/",
-                    json.dumps(
-                        {
-                            "documents": [self.doc2.id],
-                            "operations": [{"page": 1, "doc": doc_index}],
-                        },
-                    ),
-                    content_type="application/json",
-                )
-                self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
-                self.assertIn(b"doc index is out of bounds", response.content)
-
         response = self.client.post(
             "/api/documents/edit_pdf/",
             json.dumps(

src/documents/tests/test_bulk_edit.py

@@ -1642,16 +1642,6 @@ class TestPDFActions(DirectoriesMixin, TestCase):
         mock_group.assert_not_called()
         mock_consume_file.assert_not_called()
 
-    @mock.patch("pikepdf.open")
-    def test_edit_pdf_rejects_invalid_operations(self, mock_open) -> None:
-        for operations in ([], [{"page": 1, "doc": 2**32}]):
-            with self.subTest(operations=operations):
-                with self.assertLogs("paperless.bulk_edit", level="ERROR"):
-                    with self.assertRaisesRegex(ValueError, "index is out of bounds"):
-                        bulk_edit.edit_pdf([self.doc2.id], operations)
-
-        mock_open.assert_not_called()
-
     @mock.patch("documents.bulk_edit.update_document_content_maybe_archive_file.delay")
     @mock.patch("documents.tasks.consume_file.apply_async")
     @mock.patch("documents.bulk_edit.tempfile.mkdtemp")

src/documents/tests/test_regex.py

@@ -1,6 +1,5 @@
 import pytest
 import regex
-from django.conf import settings
 from pytest_mock import MockerFixture
 
 from documents.regex import safe_regex_finditer
@@ -10,12 +9,6 @@ from documents.regex import safe_regex_sub
 from documents.regex import validate_regex_pattern
 
 
-def test_regex_timeout_uses_configured_setting() -> None:
-    from documents.regex import REGEX_TIMEOUT_SECONDS
-
-    assert REGEX_TIMEOUT_SECONDS == settings.MATCH_REGEX_TIMEOUT_SECONDS
-
-
 class TestValidateRegexPattern:
     def test_valid_pattern(self) -> None:
         validate_regex_pattern(r"\d+")

src/locale/en_US/LC_MESSAGES/django.po

@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: paperless-ngx\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-09-13 22:13+0000\n"
+"POT-Creation-Date: 2026-09-12 23:18+0000\n"
 "PO-Revision-Date: 2022-02-17 04:17\n"
 "Last-Translator: \n"
 "Language-Team: English\n"
@@ -1632,7 +1632,7 @@ msgid "workflow runs"
 msgstr ""
 
 #: documents/serialisers.py:525 documents/serialisers.py:882
-#: documents/serialisers.py:2868 documents/views.py:319 documents/views.py:2694
+#: documents/serialisers.py:2854 documents/views.py:319 documents/views.py:2694
 #: paperless_mail/serialisers.py:156
 msgid "Insufficient permissions."
 msgstr ""
@@ -1641,39 +1641,39 @@ msgstr ""
 msgid "Invalid color."
 msgstr ""
 
-#: documents/serialisers.py:2341
+#: documents/serialisers.py:2327
 #, python-format
 msgid "File type %(type)s not supported"
 msgstr ""
 
-#: documents/serialisers.py:2385
+#: documents/serialisers.py:2371
 #, python-format
 msgid "Custom field id must be an integer: %(id)s"
 msgstr ""
 
-#: documents/serialisers.py:2392
+#: documents/serialisers.py:2378
 #, python-format
 msgid "Custom field with id %(id)s does not exist"
 msgstr ""
 
-#: documents/serialisers.py:2409 documents/serialisers.py:2419
+#: documents/serialisers.py:2395 documents/serialisers.py:2405
 msgid ""
 "Custom fields must be a list of integers or an object mapping ids to values."
 msgstr ""
 
-#: documents/serialisers.py:2414
+#: documents/serialisers.py:2400
 msgid "Some custom fields don't exist or were specified twice."
 msgstr ""
 
-#: documents/serialisers.py:2561
+#: documents/serialisers.py:2547
 msgid "Invalid variable detected."
 msgstr ""
 
-#: documents/serialisers.py:2924
+#: documents/serialisers.py:2910
 msgid "Duplicate document identifiers are not allowed."
 msgstr ""
 
-#: documents/serialisers.py:2954 documents/views.py:4707
+#: documents/serialisers.py:2940 documents/views.py:4707
 #, python-format
 msgid "Documents not found: %(ids)s"
 msgstr ""
@@ -2258,151 +2258,151 @@ msgstr ""
 msgid "paperless application settings"
 msgstr ""
 
-#: paperless/settings/__init__.py:560
+#: paperless/settings/__init__.py:556
 msgid "English (US)"
 msgstr ""
 
-#: paperless/settings/__init__.py:561
+#: paperless/settings/__init__.py:557
 msgid "Arabic"
 msgstr ""
 
-#: paperless/settings/__init__.py:562
+#: paperless/settings/__init__.py:558
 msgid "Afrikaans"
 msgstr ""
 
-#: paperless/settings/__init__.py:563
+#: paperless/settings/__init__.py:559
 msgid "Belarusian"
 msgstr ""
 
-#: paperless/settings/__init__.py:564
+#: paperless/settings/__init__.py:560
 msgid "Bulgarian"
 msgstr ""
 
-#: paperless/settings/__init__.py:565
+#: paperless/settings/__init__.py:561
 msgid "Catalan"
 msgstr ""
 
-#: paperless/settings/__init__.py:566
+#: paperless/settings/__init__.py:562
 msgid "Czech"
 msgstr ""
 
-#: paperless/settings/__init__.py:567
+#: paperless/settings/__init__.py:563
 msgid "Danish"
 msgstr ""
 
-#: paperless/settings/__init__.py:568
+#: paperless/settings/__init__.py:564
 msgid "German"
 msgstr ""
 
-#: paperless/settings/__init__.py:569
+#: paperless/settings/__init__.py:565
 msgid "Greek"
 msgstr ""
 
-#: paperless/settings/__init__.py:570
+#: paperless/settings/__init__.py:566
 msgid "English (GB)"
 msgstr ""
 
-#: paperless/settings/__init__.py:571
+#: paperless/settings/__init__.py:567
 msgid "Spanish"
 msgstr ""
 
-#: paperless/settings/__init__.py:572
+#: paperless/settings/__init__.py:568
 msgid "Persian"
 msgstr ""
 
-#: paperless/settings/__init__.py:573
+#: paperless/settings/__init__.py:569
 msgid "Finnish"
 msgstr ""
 
-#: paperless/settings/__init__.py:574
+#: paperless/settings/__init__.py:570
 msgid "French"
 msgstr ""
 
-#: paperless/settings/__init__.py:575
+#: paperless/settings/__init__.py:571
 msgid "Hungarian"
 msgstr ""
 
-#: paperless/settings/__init__.py:576
+#: paperless/settings/__init__.py:572
 msgid "Indonesian"
 msgstr ""
 
-#: paperless/settings/__init__.py:577
+#: paperless/settings/__init__.py:573
 msgid "Italian"
 msgstr ""
 
-#: paperless/settings/__init__.py:578
+#: paperless/settings/__init__.py:574
 msgid "Japanese"
 msgstr ""
 
-#: paperless/settings/__init__.py:579
+#: paperless/settings/__init__.py:575
 msgid "Korean"
 msgstr ""
 
-#: paperless/settings/__init__.py:580
+#: paperless/settings/__init__.py:576
 msgid "Luxembourgish"
 msgstr ""
 
-#: paperless/settings/__init__.py:581
+#: paperless/settings/__init__.py:577
 msgid "Norwegian"
 msgstr ""
 
-#: paperless/settings/__init__.py:582
+#: paperless/settings/__init__.py:578
 msgid "Dutch"
 msgstr ""
 
-#: paperless/settings/__init__.py:583
+#: paperless/settings/__init__.py:579
 msgid "Polish"
 msgstr ""
 
-#: paperless/settings/__init__.py:584
+#: paperless/settings/__init__.py:580
 msgid "Portuguese (Brazil)"
 msgstr ""
 
-#: paperless/settings/__init__.py:585
+#: paperless/settings/__init__.py:581
 msgid "Portuguese"
 msgstr ""
 
-#: paperless/settings/__init__.py:586
+#: paperless/settings/__init__.py:582
 msgid "Romanian"
 msgstr ""
 
-#: paperless/settings/__init__.py:587
+#: paperless/settings/__init__.py:583
 msgid "Russian"
 msgstr ""
 
-#: paperless/settings/__init__.py:588
+#: paperless/settings/__init__.py:584
 msgid "Slovak"
 msgstr ""
 
-#: paperless/settings/__init__.py:589
+#: paperless/settings/__init__.py:585
 msgid "Slovenian"
 msgstr ""
 
-#: paperless/settings/__init__.py:590
+#: paperless/settings/__init__.py:586
 msgid "Serbian"
 msgstr ""
 
-#: paperless/settings/__init__.py:591
+#: paperless/settings/__init__.py:587
 msgid "Swedish"
 msgstr ""
 
-#: paperless/settings/__init__.py:592
+#: paperless/settings/__init__.py:588
 msgid "Turkish"
 msgstr ""
 
-#: paperless/settings/__init__.py:593
+#: paperless/settings/__init__.py:589
 msgid "Ukrainian"
 msgstr ""
 
-#: paperless/settings/__init__.py:594
+#: paperless/settings/__init__.py:590
 msgid "Vietnamese"
 msgstr ""
 
-#: paperless/settings/__init__.py:595
+#: paperless/settings/__init__.py:591
 msgid "Chinese Simplified"
 msgstr ""
 
-#: paperless/settings/__init__.py:596
+#: paperless/settings/__init__.py:592
 msgid "Chinese Traditional"
 msgstr ""