restrict player and download access to public items (public_access = 'full'), fix...

diff --git a/telemeta/templates/telemeta/messages.html b/telemeta/templates/telemeta/messages.html
new file mode 100644 (file)
index 0000000..787f796
--- /dev/null
+++ b/telemeta/templates/telemeta/messages.html
@@ -0,0 +1 @@
+{% extends "telemeta_default/messages.html" %}

diff --git a/telemeta/templates/telemeta_default/mediaitem_add.html b/telemeta/templates/telemeta_default/mediaitem_add.html
index 7410f2f16b5976f0376aa02ab4e83afba0a505f9..71e6c06d49358ff872fa1f07b26fd9a00574c870 100644 (file)
--- a/telemeta/templates/telemeta_default/mediaitem_add.html
+++ b/telemeta/templates/telemeta_default/mediaitem_add.html
@@ -12,7 +12,7 @@
     {% block tools %}
 <!--     <a href="{% url telemeta-item-detail item.public_id %}">
          <img src="images/edit_cancel.png" /></a>-->
- <a href="{% url telemeta-item-detail item.public_id %}"
+ <a href="{% url telemeta-items %}"
            class="roundBorder6 mediaitem_button mediaitem_button_cancel">{% trans "Cancel" %}</a>
     {% endblock tools %}
     
@@ -37,7 +37,7 @@
        {% endfor %}
        </table>
        <div align="center">
-        <a href="{% url telemeta-item-detail item.public_id %}"
+        <a href="{% url telemeta-items %}"
            class="mediaitem_button mediaitem_button_cancel">{% trans "Cancel" %}</a>
         <a href="#" class="mediaitem_button mediaitem_button_save"
    onclick="document.getElementById('_addItemForm').submit(); return false;">{% trans "Save" %}</a>

diff --git a/telemeta/templates/telemeta_default/mediaitem_detail.html b/telemeta/templates/telemeta_default/mediaitem_detail.html
index 6d90431793278efc4b8ff61d6a0c8cee91c1c786..0da5cc22bd8a94c479dbe4a10b20b3c06dad7cb6 100644 (file)
--- a/telemeta/templates/telemeta_default/mediaitem_detail.html
+++ b/telemeta/templates/telemeta_default/mediaitem_detail.html
@@ -61,8 +61,8 @@
 
 {% block content %}
 <h3><img src="images/item.png" style="vertical-align:middle" /> Item : {{ item }}</h3>
-<div class="{% if item.file %}with-rightcol{% endif %}">
-    {% if item.file %}
+<div class="{% if item.file and item.public_access == 'full' %}with-rightcol{% endif %}">
+    {% if item.file and item.public_access == 'full' %}
     <div id="player_maximized" class="ts-skin-lab">
         <a href="#" class="toggle">Minimize</a>
         <div class="wazing"></div>

diff --git a/telemeta/templates/telemeta_default/mediaitem_edit.html b/telemeta/templates/telemeta_default/mediaitem_edit.html
index 3d9adc176f97fc378b79ea0439424b161d89b375..a07be4d0dd4d2da021b17afd1758b265848bd035 100644 (file)
--- a/telemeta/templates/telemeta_default/mediaitem_edit.html
+++ b/telemeta/templates/telemeta_default/mediaitem_edit.html
@@ -16,7 +16,12 @@
         {% if not field.html_name == "copied_from_item" %}
         <tr>
             <tr><td>{{ field.errors }}</td></tr>
-            <td>{{ field.label_tag }}:</td><td> {{ field }}</td>
+            <td>{{ field.label_tag }}:</td>
+             {% if field.html_name == "file" %}
+              <td> {{ item.file.name }} <br /> {{ field }}</td>
+             {% else %}
+              <td> {{ field }}</td>
+             {% endif %}
         </tr>
         {% endif %}
        {% endfor %}

diff --git a/telemeta/templates/telemeta_default/messages.html b/telemeta/templates/telemeta_default/messages.html
new file mode 100644 (file)
index 0000000..300986d
--- /dev/null
+++ b/telemeta/templates/telemeta_default/messages.html
@@ -0,0 +1,13 @@
+{% extends "telemeta/base.html" %}
+{% load i18n %}
+
+{% block content %}
+
+{% if messages %}
+ {% for message in messages %}
+  <h3>{{ message }}</h3>
+ {% endfor %}
+{% endif %}
+
+{% endblock %}
+

diff --git a/telemeta/urls.py b/telemeta/urls.py
index 4a1ac4f76d476865e538d6abeea202dff2c03083..b4721389b001060ab9d6df1c6e6038af155d638d 100644 (file)
--- a/telemeta/urls.py
+++ b/telemeta/urls.py
@@ -206,5 +206,8 @@ urlpatterns = patterns('',
     url(r'^markers/(?P<marker_id>[A-Za-z0-9]+)/$', web_view.item_detail, name="telemeta-item-detail-marker"),
         
     # RSS feeds
-    url(r'rss/$', web_view.rss, name="telemeta-rss"),
+    url(r'^rss/$', web_view.rss, name="telemeta-rss"),
+    
+    # Not allowed
+    url(r'^not_allowed/$', web_view.not_allowed, name="telemeta-not-allowed"),
 )

diff --git a/telemeta/web/base.py b/telemeta/web/base.py
index 94ad4d58b95a7e7689bd755b4d9fd4e31eeb0386..36ac79792370a067c8c7e1acdf3a59dd3fd54887 100644 (file)
--- a/telemeta/web/base.py
+++ b/telemeta/web/base.py
@@ -51,6 +51,7 @@ from django.shortcuts import render_to_response, redirect
 from django.views.generic import list_detail
 from django.conf import settings
 from django.contrib import auth
+from django.contrib import messages
 from django.contrib.auth.decorators import login_required, permission_required
 from django.core.context_processors import csrf
 from django.forms.models import modelformset_factory
@@ -400,9 +401,11 @@ class WebView(object):
 
     def item_export(self, request, public_id, extension):                    
         """Export a given media item in the specified format (OGG, FLAC, ...)"""
-
-        if extension != 'mp3' and not getattr(settings, 'TELEMETA_DOWNLOAD_ENABLED', False):
-            raise Http404 # FIXME: should be some sort of permissions denied error
+        
+        item = MediaItem.objects.get(public_id=public_id)
+        
+        if extension != 'mp3' and not getattr(settings, 'TELEMETA_DOWNLOAD_ENABLED', False) or item.public_access != 'full':
+            return HttpResponseRedirect('/not_allowed/')
 
         for encoder in self.encoders:
             if encoder.file_extension() == extension:
@@ -413,7 +416,6 @@ class WebView(object):
 
         mime_type = encoder.mime_type()
         file = public_id + '.' + encoder.file_extension()
-        item = MediaItem.objects.get(public_id=public_id)
         audio = item.file.path
         decoder = timeside.decoder.FileDecoder(audio)
 
@@ -942,7 +944,8 @@ class WebView(object):
         
         feed = rss.to_xml(encoding='utf-8')
         response = HttpResponse(feed, mimetype='application/rss+xml')
-        
         return response
         
-        
+    def not_allowed(self, request):
+        messages.error(request, 'Not allowed')
+        return render(request, 'telemeta/messages.html')