apps/comments/tests/test_v2.py

@@ -150,6 +150,20 @@ def test_non_htmx_post_still_redirects(client, _article):
     assert resp["Location"].endswith("?commented=1")
 
 
+@pytest.mark.django_db
+def test_htmx_error_with_tampered_parent_id_falls_back_to_main_form(client, _article):
+    """Tampered/non-numeric parent_id falls back to main form error response."""
+    cache.clear()
+    resp = client.post(
+        "/comments/post/",
+        {"article_id": _article.id, "parent_id": "not-a-number", "author_name": "T",
+         "author_email": "t@t.com", "body": "   ", "honeypot": ""},
+        HTTP_HX_REQUEST="true",
+    )
+    assert resp.status_code == 200
+    assert b"comment-form-container" in resp.content
+
+
 # ── Turnstile Integration ────────────────────────────────────────────────────
 
 

apps/comments/views.py

@@ -121,15 +121,20 @@ def _comment_template_context(comment, article, request):
 class CommentCreateView(View):
     def _render_htmx_error(self, request, article, form):
         """Return error form partial for HTMX — swaps the form container itself."""
-        parent_id = request.POST.get("parent_id")
+        raw_parent_id = request.POST.get("parent_id")
-        if parent_id:
+        if raw_parent_id:
-            parent = Comment.objects.filter(pk=parent_id, article=article).first()
+            try:
-            ctx = {
+                parent_id = int(raw_parent_id)
-                "comment": parent, "page": article,
+            except (ValueError, TypeError):
-                "turnstile_site_key": _turnstile_site_key(),
+                parent_id = None
-                "reply_form_errors": form.errors,
+            parent = Comment.objects.filter(pk=parent_id, article=article).first() if parent_id else None
-            }
+            if parent:
-            return _add_vary_header(render(request, "comments/_reply_form.html", ctx))
+                ctx = {
+                    "comment": parent, "page": article,
+                    "turnstile_site_key": _turnstile_site_key(),
+                    "reply_form_errors": form.errors,
+                }
+                return _add_vary_header(render(request, "comments/_reply_form.html", ctx))
         ctx = {
             "comment_form": form, "page": article,
             "turnstile_site_key": _turnstile_site_key(),