security fix for document access

diff --git a/teleforma/templates/teleforma/course_document.html b/teleforma/templates/teleforma/course_document.html
index 18cacf11c11de54747753e69ce93136f7f884b4c..a88f1ff50413794d6a3ab628ce4c2fcbe9ec68be 100644 (file)
--- a/teleforma/templates/teleforma/course_document.html
+++ b/teleforma/templates/teleforma/course_document.html
@@ -55,12 +55,19 @@ PDFJS.getDocument('{% url teleforma-document-download document.id %}').then(func
 {% block course %}
 <div class="course_media">
 
-<div class="course_title">{{ document.title }}{% if document.description %} - {{ document.description }}{% endif %}
+<div class="course_title">{{ document.course.title }}{% for type in document.course_type.all%} - {{ type }}{% endfor %}{% if document.type %} - {{ document.type }}{% endif %}<br />
+{% if document.title %}<h4>{{ document.title }}</h4>{% endif %}
 </div>
 
+{% if not access %}
+  <p>{{ access_error }}</p>
+  <p>{{ message }}</p>
+
+{% else %}
 <div class="media">
 <canvas id="the-canvas" style="border:1px solid black;"/>
 </div>
+{% endif %}
 
 {% block general_info %}
 <div class="course_content" id="media_infos">

diff --git a/teleforma/templates/teleforma/inc/document_list.html b/teleforma/templates/teleforma/inc/document_list.html
index 04de9caac962efed25c02676221bb0cb6851ffdc..42ad3422c32dce08c0b605ea837bfb933af75c31 100644 (file)
--- a/teleforma/templates/teleforma/inc/document_list.html
+++ b/teleforma/templates/teleforma/inc/document_list.html
@@ -22,7 +22,7 @@
     <tbody>
         {% for document in course.document.all|from_course_type:type|from_doc_type:doc_type %}
         <tr {% if not forloop.counter0|divisibleby:"2" %}class="odd"{% endif %}>
-        <td>{% if document.file %}<a href="{% url teleforma-document-detail document.id %}" target="_blank">{% endif %}{{ document.title }}{% if document.file %}</a>{% endif %}</td>
+        <td>{% if document.file %}<a href="{% url teleforma-document-view document.id %}" target="_blank">{% endif %}{{ document.title }}{% if document.file %}</a>{% endif %}</td>
         <td align="center">
         {% if document.is_annal %}
           <img src="images/ok.png" alt="yes" style="vertical-align:middle" />&nbsp;

diff --git a/teleforma/urls.py b/teleforma/urls.py
index ef785f158d6082ffd96a6437b422128729d41d9c..86af5fbdf9b97c3e6a4fc06899d4b904b2374387 100644 (file)
--- a/teleforma/urls.py
+++ b/teleforma/urls.py
@@ -44,6 +44,7 @@ from jsonrpc import jsonrpc_site
 htdocs_forma = os.path.dirname(__file__) + '/static/teleforma/'
 user_export = UsersXLSExport()
 profile_view = ProfileView()
+document = DocumentView()
 
 urlpatterns = patterns('',
 #    url(r'^$', HomeView.as_view(), name='teleforma-home'),
@@ -53,13 +54,19 @@ urlpatterns = patterns('',
     # Telemeta
     url(r'^', include('telemeta.urls')),
 
+    # Desk
     url(r'^desk/$', CoursesView.as_view(), name="teleforma-desk"),
     url(r'^desk/courses/(?P<pk>.*)/$', CourseView.as_view(), name="teleforma-course-detail"),
     url(r'^desk/medias/(?P<pk>.*)/$', MediaView.as_view(), name="teleforma-media-detail"),
-    url(r'^desk/documents/(?P<pk>.*)/view/$', document_view, name="teleforma-document-detail"),
-    url(r'^desk/documents/(?P<pk>.*)/download/$', document_download, name="teleforma-document-download"),
+    url(r'^desk/documents/(?P<pk>.*)/detail/$', DocumentView.as_view(),
+        name="teleforma-document-detail"),
+    url(r'^desk/documents/(?P<pk>.*)/download/$', document.download,
+        name="teleforma-document-download"),
+    url(r'^desk/documents/(?P<pk>.*)/view/$', document.view,
+        name="teleforma-document-view"),
 #    url(r'^desk/documents/(?P<pk>.*)/view/$', document_view, name="teleforma-document-view"),
-    url(r'^desk/conferences/(?P<pk>.*)/$', ConferenceView.as_view(), name="teleforma-conference-detail"),
+    url(r'^desk/conferences/(?P<pk>.*)/$', ConferenceView.as_view(),
+        name="teleforma-conference-detail"),
 
     # Postman
     url(r'^messages/', include('postman.urls')),
@@ -72,13 +79,15 @@ urlpatterns = patterns('',
     url(r'^users/all/export/$', user_export.all, name="teleforma-users-xls-export"),
 
     url(r'^users/by_training/(\w+)/$', UsersTrainingView.as_view(), name="teleforma-training-users"),
-    url(r'^users/by_training/(?P<id>.*)/export/$', user_export.by_training, name="teleforma-training-users-export"),
+    url(r'^users/by_training/(?P<id>.*)/export/$', user_export.by_training,
+        name="teleforma-training-users-export"),
 
     url(r'^users/by_iej/(\w+)/$', UsersIejView.as_view(), name="teleforma-iej-users"),
     url(r'^users/by_iej/(?P<id>.*)/export/$', user_export.by_iej, name="teleforma-iej-users-export"),
 
     url(r'^users/by_course/(\w+)/$', UsersCourseView.as_view(), name="teleforma-course-users"),
-    url(r'^users/by_course/(?P<id>.*)/export/$', user_export.by_course, name="teleforma-course-users-export"),
+    url(r'^users/by_course/(?P<id>.*)/export/$', user_export.by_course,
+        name="teleforma-course-users-export"),
 
 
 # CSS+Images (FIXME: for developement only)

diff --git a/teleforma/views.py b/teleforma/views.py
index b8fefac721781b807a8b53f4475aa0aec0becc85..0122efb2d5ad8c955091aeb9635fd39957090562 100755 (executable)
--- a/teleforma/views.py
+++ b/teleforma/views.py
@@ -118,23 +118,6 @@ def stream_from_file(__file):
             break
         yield __chunk
 
-def document_download(request, pk):
-    document = Document.objects.get(id=pk)
-    fsock = open(document.file.path, 'r')
-    mimetype = mimetypes.guess_type(document.file.path)[0]
-    extension = mimetypes.guess_extension(mimetype)
-    response = HttpResponse(fsock, mimetype=mimetype)
-    response['Content-Disposition'] = "attachment; filename=%s%s" % \
-                                     (document.title.encode('utf8'), extension)
-    return response
-
-def document_view(request, pk):
-    document = Document.objects.get(id=pk)
-    fsock = open(document.file.path, 'r')
-    mimetype = mimetypes.guess_type(document.file.path)[0]
-    extension = mimetypes.guess_extension(mimetype)
-    response = HttpResponse(fsock, mimetype=mimetype)
-    return response
 
 def get_room(content_type=None, id=None, name=None):
     rooms = jqchat.models.Room.objects.filter(content_type=content_type,
@@ -224,10 +207,21 @@ class DocumentView(DetailView):
 
     model = Document
     template_name='teleforma/course_document.html'
+    access_error = ugettext('Access not allowed')
+    message = ugettext('Please login or contact the website administator to get a private access.')
+
+
+    def get_access(self, obj, courses):
+        access = False
+        for course in courses:
+            if obj.course == course['course']:
+                access = True
+        return access
 
     def get_context_data(self, **kwargs):
         context = super(DocumentView, self).get_context_data(**kwargs)
-        context['courses'] = get_courses(self.request.user)
+        all_courses = get_courses(self.request.user)
+        context['all_courses'] = all_courses
         document = self.get_object()
 #        context['mime_type'] = view.item_analyze(media.item)
         context['course'] = document.course
@@ -235,12 +229,42 @@ class DocumentView(DetailView):
         content_type = ContentType.objects.get(app_label="teleforma", model="document")
         context['room'] = get_room(name=document.title, content_type=content_type,
                                    id=document.id)
+        access = self.get_access(document, all_courses)
+        if not access:
+            context['access_error'] = self.access_error
+            context['message'] = self.message
         return context
 
     @method_decorator(login_required)
     def dispatch(self, *args, **kwargs):
         return super(DocumentView, self).dispatch(*args, **kwargs)
 
+    def download(self, request, pk):
+        courses = get_courses(request.user)
+        document = Document.objects.get(id=pk)
+        if self.get_access(document, courses):
+            fsock = open(document.file.path, 'r')
+            mimetype = mimetypes.guess_type(document.file.path)[0]
+            extension = mimetypes.guess_extension(mimetype)
+            response = HttpResponse(fsock, mimetype=mimetype)
+            response['Content-Disposition'] = "attachment; filename=%s%s" % \
+                                             (document.title.encode('utf8'), extension)
+            return response
+        else:
+            return redirect('teleforma-document-detail', document.id)
+
+    def view(self, request, pk):
+        courses = get_courses(request.user)
+        document = Document.objects.get(id=pk)
+        if self.get_access(document, courses):
+            fsock = open(document.file.path, 'r')
+            mimetype = mimetypes.guess_type(document.file.path)[0]
+            extension = mimetypes.guess_extension(mimetype)
+            response = HttpResponse(fsock, mimetype=mimetype)
+            return response
+        else:
+            return redirect('teleforma-document-detail', document.id)
+
 class ConferenceView(DetailView):
 
     model = Conference