Validate weekends year range and fix trip page unbooked-flight helper call

web_view.py

@@ -268,6 +268,16 @@ async def gaps_page() -> str:
 async def weekends() -> str:
     """List of available weekends using an optional date, week, or year parameter."""
     today = datetime.now().date()
+    min_year = 2020
+    max_year = today.year + 5
+
+    def validate_year(year: int) -> None:
+        """Validate year parameter range for weekends page."""
+        if year < min_year or year > max_year:
+            flask.abort(
+                400, description=f"Year must be between {min_year} and {max_year}."
+            )
+
     date_str = flask.request.args.get("date")
     week_str = flask.request.args.get("week")
     year_str = flask.request.args.get("year")
@@ -275,12 +285,14 @@ async def weekends() -> str:
     if date_str:
         try:
             start = datetime.strptime(date_str, "%Y-%m-%d").date()
+            validate_year(start.year)
         except ValueError:
             return flask.abort(400, description="Invalid date format. Use YYYY-MM-DD.")
     elif week_str:
         try:
             week = int(week_str)
             year = int(year_str) if year_str else today.year
+            validate_year(year)
             if week < 1 or week > 53:
                 return flask.abort(
                     400, description="Week number must be between 1 and 53."
@@ -293,6 +305,13 @@ async def weekends() -> str:
             return flask.abort(
                 400, description="Invalid week or year format. Use integers."
             )
+    elif year_str:
+        try:
+            year = int(year_str)
+            validate_year(year)
+            start = date(year, 1, 1)
+        except ValueError:
+            return flask.abort(400, description="Invalid year format. Use an integer.")
     else:
         start = date(today.year, 1, 1)
 
@@ -914,9 +933,7 @@ def get_destination_timezones(trip: Trip) -> list[StrDict]:
                 if flight_country:
                     flight_locations.append((city, flight_country))
 
-    existing_location_keys = {
-        (loc, c.alpha_2.lower()) for loc, c in trip.locations()
-    }
+    existing_location_keys = {(loc, c.alpha_2.lower()) for loc, c in trip.locations()}
     all_locations = list(trip.locations()) + [
         (city, country)
         for city, country in flight_locations
@@ -1018,7 +1035,9 @@ def trip_page(start: str) -> str:
     coordinates = agenda.trip.collect_trip_coordinates(trip)
     routes = agenda.trip.get_trip_routes(trip, app.config["PERSONAL_DATA"])
 
-    agenda.trip.add_coordinates_for_unbooked_flights(routes, coordinates)
+    agenda.trip.add_coordinates_for_unbooked_flights(
+        routes, coordinates, app.config["PERSONAL_DATA"]
+    )
 
     for route in routes:
         if "geojson_filename" in route: