fix security access by period to course list and detail

diff --git a/teleforma/templates/teleforma/courses.html b/teleforma/templates/teleforma/courses.html
index f8d8213935030cbcd2aefd0a9ae95ef15de3e8a9..abca6dfd3304fc065963dfd10171ab61e1f7264a 100644 (file)
--- a/teleforma/templates/teleforma/courses.html
+++ b/teleforma/templates/teleforma/courses.html
@@ -65,7 +65,9 @@ $(document).ready(function(){
 
 
 {% block course %}
+
 <div class="desk_center">
+
     {% for c in object_list %}
      {% with c.course as course %}
       {% for type in c.types %}

diff --git a/teleforma/views/core.py b/teleforma/views/core.py
index 7ad7870a93ff1c14b38fc16b31d02f4d7a107522..94155cede80616acb0bd52712661bd7e383d464a 100644 (file)
--- a/teleforma/views/core.py
+++ b/teleforma/views/core.py
@@ -204,14 +204,27 @@ class CourseView(DetailView):
         return super(CourseView, self).dispatch(*args, **kwargs)
 
 
-class PeriodCourseView(CourseView):
+class PeriodAccessMixin(object):
+
+    def render_to_response(self, context):
+        period = context['period']
+        if not period in get_periods(self.request.user):
+            messages.warning(self.request, _("You do NOT have access to this resource and then have been redirected to your desk."))
+            return redirect('teleforma-home')
+        return super(PeriodAccessMixin, self).render_to_response(context)
+
+
+class PeriodCourseView(PeriodAccessMixin, CourseView):
 
     def get_context_data(self, **kwargs):
         context = super(PeriodCourseView, self).get_context_data(**kwargs)
-        context['period'] = Period.objects.get(id=int(self.kwargs['period_id']))
+        self.period = None
+        period = Period.objects.filter(id=int(self.kwargs['period_id']))
+        if period:
+            self.period = period[0]
+        context['period'] = self.period
         return context
 
-
 class CoursesView(ListView):
 
     model = Course
@@ -234,10 +247,14 @@ class CoursesView(ListView):
         return super(CoursesView, self).dispatch(*args, **kwargs)
 
 
-class PeriodListView(CoursesView):
+class PeriodListView(PeriodAccessMixin, CoursesView):
 
     def get_queryset(self):
-        self.period = Period.objects.get(id=int(self.kwargs['period_id']))
+        self.period = None
+        period = Period.objects.filter(id=int(self.kwargs['period_id']))
+        if period:
+            self.period = period[0]
+
         self.all_courses = get_courses(self.request.user, date_order=True, period=self.period)
         return self.all_courses[:5]