Delete, Undelete or Archive actions on a thread must not affect non accepted received...

diff --git a/postman/models.py b/postman/models.py
index a5e3a8f6966c2cc125cfc086652c092657ea174e..5174af588f0d13162fac29f5e87b69f9cd5313e8 100644 (file)
--- a/postman/models.py
+++ b/postman/models.py
@@ -174,6 +174,18 @@ class MessageManager(models.Manager):
             (models.Q(recipient=user) & models.Q(moderation_status=STATUS_ACCEPTED)) | models.Q(sender=user),
         ).order_by('sent_at')
 
+    def as_recipient(self, user, filter):
+        """
+        Return messages matching a filter AND being visible to a user as the recipient.
+        """
+        return self.filter(filter, recipient=user, moderation_status=STATUS_ACCEPTED)
+
+    def as_sender(self, user, filter):
+        """
+        Return messages matching a filter AND being visible to a user as the sender.
+        """
+        return self.filter(filter, sender=user) # any status is fine
+
     def perms(self, user):
         """
         Return a field-lookups filter as a permission controller for a reply request.

diff --git a/postman/views.py b/postman/views.py
index fc66386067534c9f11bc5b42d44e6b9f2f299a77..12ba1972123ab9498294c7b6d32a1a3b921526c6 100644 (file)
--- a/postman/views.py
+++ b/postman/views.py
@@ -270,10 +270,10 @@ def _update(request, field_bit, success_msg, field_value=None, success_url=None)
     pks = request.POST.getlist('pks')
     tpks = request.POST.getlist('tpks')
     if pks or tpks:
-        queryset = Message.objects.filter(Q(pk__in=pks) | Q(thread__in=tpks))
         user = request.user
-        recipient_rows = queryset.filter(recipient=user).update(**{'recipient_{0}'.format(field_bit): field_value})
-        sender_rows = queryset.filter(sender=user).update(**{'sender_{0}'.format(field_bit): field_value})
+        filter = Q(pk__in=pks) | Q(thread__in=tpks)
+        recipient_rows = Message.objects.as_recipient(user, filter).update(**{'recipient_{0}'.format(field_bit): field_value})
+        sender_rows = Message.objects.as_sender(user, filter).update(**{'sender_{0}'.format(field_bit): field_value})
         if not (recipient_rows or sender_rows):
             raise Http404 # abnormal enough, like forged ids
         messages.success(request, success_msg, fail_silently=True)