tonumber accepts points and commas in a number. With this patch nothing but digits is taken as a source number.
Pagure's pull request system is apparently too limited to handle more than one issue at a time, so I hope attaching a patch works.