reynir/bornhack-website
1
0
Fork 0
Code Issues Pull requests 1 Releases Wiki Activity

fix user check

Browse source
This commit is contained in:
Thomas Steen Rasmussen 2017-03-14 18:06:23 +01:00
parent e316ebbb44
commit d159844750
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/program/views.py
View file

@ -28,7 +28,7 @@ class ProposalListView(LoginRequiredMixin, CampViewMixin, ListView):
def get_context_data(self, **kwargs):
context = super().get_context_data(**kwargs)
# add eventproposals to the context
# also add eventproposals to the context
context['eventproposal_list'] = models.EventProposal.objects.filter(camp=self.camp, user=self.request.user)
return context
@ -38,6 +38,9 @@ class SpeakerProposalCreateView(LoginRequiredMixin, CampViewMixin, CreateProposa
fields = ['name', 'biography', 'picture_small', 'picture_large']
template_name = 'speakerproposal_form.html'
def get_success_url(self):
return reverse('proposal_list', kwargs={'camp_slug': self.camp.slug})
class SpeakerProposalUpdateView(LoginRequiredMixin, CampViewMixin, EnsureUserOwnsProposalMixin, EnsureUnapprovedProposalMixin, EnsureWritableCampMixin, UpdateView):
model = models.SpeakerProposal
@ -78,8 +81,8 @@ class SpeakerProposalPictureView(LoginRequiredMixin, CampViewMixin, EnsureUserOw
model = models.SpeakerProposal
def get(self, request, *args, **kwargs):
# is the speaker public, or owned by current user?
if not self.get_object().user != request.user:
# is the proposal owned by current user?
if self.get_object().user != request.user:
raise Http404()
# do we have the requested picture?
@ -94,6 +97,7 @@ class SpeakerProposalPictureView(LoginRequiredMixin, CampViewMixin, EnsureUserOw
else:
raise Http404()
else:
# only 'thumbnail' and 'large' pictures supported
raise Http404()
# make nginx return the picture using X-Accel-Redirect