fix security access on conferences

diff --git a/teleforma/templates/teleforma/course_conference.html b/teleforma/templates/teleforma/course_conference.html
index 565f141adb63a2b88e728c23d1a4e2de67bbd8e9..aa87f73a90d0031a448a815f83075f78837536cf 100644 (file)
--- a/teleforma/templates/teleforma/course_conference.html
+++ b/teleforma/templates/teleforma/course_conference.html
@@ -37,6 +37,12 @@
 </div>
 
 <div class="media">
+{% if access_error %}
+  <p>{{ access_error }}</p>
+  <p>{{ message }}</p>
+
+{% else %}
+
 {% for livestream in livestreams %}
 {% if "webm" == livestream.stream_type %}
 <div class="video">
@@ -47,6 +53,8 @@
 </div>
 {% endif %}
 {% endfor %}
+
+{% endif %}
 </div>
 
 {% block general_info %}

diff --git a/teleforma/templates/teleforma/course_conference_audio.html b/teleforma/templates/teleforma/course_conference_audio.html
index ea3248f6b3ad0d9e585161cfa647c2dde3458d2b..16b64c71ae2be58c56c6d377654306ec1eb3953c 100644 (file)
--- a/teleforma/templates/teleforma/course_conference_audio.html
+++ b/teleforma/templates/teleforma/course_conference_audio.html
@@ -37,6 +37,12 @@
 </div>
 
 <div class="media">
+{% if access_error %}
+  <p>{{ access_error }}</p>
+  <p>{{ message }}</p>
+
+{% else %}
+
 {% for livestream in livestreams %}
 {% if "mp3" == livestream.stream_type %}
 <div class="audio">
@@ -47,6 +53,8 @@
 </div>
 {% endif %}
 {% endfor %}
+
+{% endif %}
 </div>
 
 {% block general_info %}

diff --git a/teleforma/urls.py b/teleforma/urls.py
index d73a20455e146f60711278f33feb02057c766ebe..285d92f04933d6b4706598426598a2937987537c 100644 (file)
--- a/teleforma/urls.py
+++ b/teleforma/urls.py
@@ -75,7 +75,7 @@ urlpatterns = patterns('',
 
     url(r'^desk/conferences/(?P<pk>.*)/$', ConferenceView.as_view(),
         name="teleforma-conference-detail"),
-    url(r'^desk/conferences/(?P<pk>.+)/audio/$', ConferenceView.as_view(template_name="teleforma/course_conference_audio.html"),
+    url(r'^desk/conferences/(?P<pk>.*)/audio/$', ConferenceView.as_view(template_name="teleforma/course_conference_audio.html"),
         name="teleforma-conference-audio"),
     url(r'^desk/conference_record/$', ConferenceRecordView.as_view(),
         name="teleforma-conference-record"),

diff --git a/teleforma/views.py b/teleforma/views.py
index 24c086b8401d295c237185d121ea57af9cf29d26..f5f2411217d77991d40bc9ae102b444bb8e47f34 100755 (executable)
--- a/teleforma/views.py
+++ b/teleforma/views.py
@@ -328,7 +328,8 @@ class ConferenceView(DetailView):
 
     def get_context_data(self, **kwargs):
         context = super(ConferenceView, self).get_context_data(**kwargs)
-        context['all_courses'] = get_courses(self.request.user)
+        all_courses = get_courses(self.request.user)
+        context['all_courses'] = all_courses
         conference = self.get_object()
         context['course'] = conference.course
         context['type'] = conference.course_type
@@ -338,6 +339,10 @@ class ConferenceView(DetailView):
                                    id=conference.id)
         context['livestreams'] = conference.livestream.all()
         context['host'] = get_host(self.request)
+        access = get_access(conference, all_courses)
+        if not access:
+            context['access_error'] = access_error
+            context['message'] = contact_message
         return context
 
     @jsonrpc_method('teleforma.conference_stop')
@@ -352,6 +357,7 @@ class ConferenceView(DetailView):
             station.save()
             station.stop()
 
+    @method_decorator(login_required)
     def dispatch(self, *args, **kwargs):
         return super(ConferenceView, self).dispatch(*args, **kwargs)