docs: more strict control in ajax get_pair

project/docs/views/ajax.py

@@ -15,6 +15,11 @@ def get_pair(request, model, param1, val1, param2):
     if not request.is_ajax():
         return HttpResponseBadRequest()
 
+    if model not in ('Country', 'Measure',):
+        return HttpResponseBadRequest()
+
+    raise_if_no_profile(request)
+
     kwargs = {param1: val1}
 
     try: