get_or_404 method does validation for ID beeing an INT

rhodecode/model/db.py

@@ -118,7 +118,11 class BaseModel(object):
 
     @classmethod
     def get_or_404(cls, id_):
-        if id_:
+        try:
+            id_ = int(id_)
+        except (TypeError, ValueError):
+            raise HTTPNotFound
+
             res = cls.query().get(id_)
             if not res:
                 raise HTTPNotFound