add security to seminar pages access, redirect to desk

diff --git a/teleforma/context_processors.py b/teleforma/context_processors.py
index 8d97bf95d25846a328969cc94305a25972a487d2..ec08417c49ebc6e371b2025841026051a0126c53 100644 (file)
--- a/teleforma/context_processors.py
+++ b/teleforma/context_processors.py
@@ -63,16 +63,16 @@ def seminar_progress(user, seminar):
         return 0
 
 def seminar_validated(user, seminar):
-    validated = [False]
+    validated = []
     questions = seminar.question.filter(status=3)
     if questions:
         for question in questions:
-            answers = Answer.objects.filter(question=question, user=user)
+            answers = Answer.objects.filter(question=question, user=user,
+                                            validated=True, treated=True)
             if answers:
-                if answers[0].validated:
-                    validated.append(True)
-                else:
-                    validated.append(False)
+                validated.append(True)
+            else:
+                validated.append(False)
         return not False in validated
     return False
 

diff --git a/teleforma/templates/forms/includes/built_form.html b/teleforma/templates/forms/includes/built_form.html
index 1a36c6085d39523da9c3f5b226f65cb5c53fe89d..7bcf7d70efa18483fe411ab854d4b600d3d9ea82 100644 (file)
--- a/teleforma/templates/forms/includes/built_form.html
+++ b/teleforma/templates/forms/includes/built_form.html
@@ -2,11 +2,11 @@
     <p>{{ form.intro }}</p>
     {% endif %}
 
-    <form action="" id="_Form" method="post" 
+    <form action="" id="_Form" method="post"
         {% if form_for_form.is_multipart %}enctype="multipart/form-data"{% endif %}>
         {% csrf_token %}
         {{ form_for_form.as_p }}
-        
+
         <div class="form-button">
         <a href="#" class="component_icon button icon_ok" onclick="$('#_Form').submit(); return false;"> {{ form.button_text }}</a>
         </div>

diff --git a/teleforma/templates/teleforma/inc/question_list.html b/teleforma/templates/teleforma/inc/question_list.html
index 1a4c1600bbacdbac38cecb4317f4430e62fec087..f87b7b7b377bf424d7fed8c4af2d290fa0757e01 100644 (file)
--- a/teleforma/templates/teleforma/inc/question_list.html
+++ b/teleforma/templates/teleforma/inc/question_list.html
@@ -6,7 +6,7 @@
         {% for question in questions.all %}
             <tr>
             <td {% if forloop.first %}class="border-top"{% endif %} width="35%">
-               <a href="{% url teleforma-question-answer question.id %}">{{ question.title }}{% if question.rank %} n°{{ question.rank }}{% endif %}</a></td>
+               <a href="{% url teleforma-question-answer seminar.id question.id %}">{{ question.title }}{% if question.rank %} n°{{ question.rank }}{% endif %}</a></td>
             <td {% if forloop.first %}class="border-top"{% endif %} width="60%">
                {% if question|submitted:user and not question|validated:user %}
                        {% trans "submitted on" %} {{ question|submitted:user }}

diff --git a/teleforma/templates/teleforma/inc/question_step.html b/teleforma/templates/teleforma/inc/question_step.html
index e74e6eea5b6aab130881cfe2378d1dfbddca8b14..426eb8fc2b6923ee87db4d822aa6845b4a6be65c 100644 (file)
--- a/teleforma/templates/teleforma/inc/question_step.html
+++ b/teleforma/templates/teleforma/inc/question_step.html
@@ -6,7 +6,7 @@
         {% for question in questions.all %}
             <tr>
             <td {% if forloop.first %}class="border-top"{% endif %} width="95%">
-               <a href="{% url teleforma-question-answer question.id %}">{{ question.title }}{% if question.rank %} n°{{ question.rank }}{% endif %}</a></td>
+               <a href="{% url teleforma-question-answer seminar.id question.id %}">{{ question.title }}{% if question.rank %} n°{{ question.rank }}{% endif %}</a></td>
             <td {% if forloop.first %}class="border-top"{% endif %} width="5%" align="center">
                {% if question|submitted:user and not question|validated:user %}
                        <img src="{{ STATIC_URL }}teleforma/images/chronometer.png" style="vertical-align:middle" alt="" title="{% trans "Waiting for validation" %}" />

diff --git a/teleforma/templates/teleforma/seminar_detail.html b/teleforma/templates/teleforma/seminar_detail.html
index b6bf2e5868087481107e592daeb4fb376aeea040..30ef9808c924257cfc403f73e35dd96db08ffc63 100644 (file)
--- a/teleforma/templates/teleforma/seminar_detail.html
+++ b/teleforma/templates/teleforma/seminar_detail.html
@@ -41,7 +41,7 @@ $(function () {
 <div class="desk_center" id="desk_center">
 
     <div class="course">
-        
+
         <div class="course_title">
          <a href="{% url teleforma-seminar-detail seminar.id %}">{{ seminar.title }}</a>
 
@@ -54,13 +54,13 @@ $(function () {
         </div>
 
         {% block course_content %}
-      
+
         <div class="course_content">
           <div class="course_subtitle">
              <h3><img src="{{ STATIC_URL }}telemeta/images/item_title.png" width="10px" alt="" /> {% trans "Informations" %}</h3>
             </div>
             <div class="course_description">
-              {% include "teleforma/inc/seminar_description.html" %} 
+              {% include "teleforma/inc/seminar_description.html" %}
             </div>
         {% if messages %}
          <div class="messages">
@@ -70,7 +70,7 @@ $(function () {
          </div>
          {% endif %}
        </div>
-        
+
       {% with seminar.docs_1 as docs %}
        <div class="course_content">
         <div class="course_subtitle">
@@ -88,7 +88,7 @@ $(function () {
         {% include "teleforma/inc/media_package_list.html" %}
        </div>
       {% endwith %}
-  
+
 
      {% with seminar.docs_2 as docs %}
        <div class="course_content">
@@ -128,7 +128,7 @@ $(function () {
        </div>
       {% endwith %}
      {% endif %}
-      
+
      {% if seminar_validated and seminar_progress == 100 %}
        <div class="course_content">
         <div class="course_subtitle">

diff --git a/teleforma/templates/teleforma/seminars.html b/teleforma/templates/teleforma/seminars.html
index 8b80d4dd03d0b4688046f073d617841801facd1a..0b68899e87644a2bfdbe84aceab3d750d9a3e9af 100644 (file)
--- a/teleforma/templates/teleforma/seminars.html
+++ b/teleforma/templates/teleforma/seminars.html
@@ -88,8 +88,16 @@ $(function() {
 {% block course %}
 
 <div class="desk_center">
+      {% if messages %}
+         <div class="messages">
+            {% for message in messages %}
+            <div{% if message.tags %} class="{{ message.tags }}"{% endif %}>{{ message }}</div>
+            {% endfor %}
+         </div>
+     {% endif %}
+
     {% for seminar in object_list %}
-      
+
       <div class="course">
         <div class="course_title">
          <a href="{% url teleforma-seminar-detail seminar.id %}">{{ seminar.title }}</a>
@@ -108,8 +116,8 @@ $(function() {
             <div class="course_description">
               <a href="{% url teleforma-seminar-detail seminar.id %}">
              <table>
-              <tr><td width="97%">   
-               {% include "teleforma/inc/seminar_description.html" %} 
+              <tr><td width="97%">
+               {% include "teleforma/inc/seminar_description.html" %}
               </td>
               <td>
                <a href="{% url teleforma-seminar-detail seminar.id %}" class="component_icon button icon_next"> {% trans "Access" %}</a>

diff --git a/teleforma/urls.py b/teleforma/urls.py
index 81cdecfa35baaaf50aed30c1e6eb60ea3126f515..85fe954c005c4f5eb80790201449324f61b647c0 100644 (file)
--- a/teleforma/urls.py
+++ b/teleforma/urls.py
@@ -69,14 +69,14 @@ urlpatterns = patterns('',
     url(r'^desk/medias/(?P<pk>.*)/detail/$', MediaView.as_view(), name="teleforma-media-detail"),
     url(r'^desk/medias/(?P<pk>.*)/download/$', media.download, name="teleforma-media-download"),
 
-    url(r'^desk/seminars/(?P<id>.*)/media/(?P<pk>.*)/video/$', 
-            SeminarMediaView.as_view(template_name='teleforma/seminar_media_video.html'), 
+    url(r'^desk/seminars/(?P<id>.*)/media/(?P<pk>.*)/video/$',
+            SeminarMediaView.as_view(template_name='teleforma/seminar_media_video.html'),
             name="teleforma-media-video"),
-    url(r'^desk/seminars/(?P<id>.*)/media/(?P<pk>.*)/audio/$', 
+    url(r'^desk/seminars/(?P<id>.*)/media/(?P<pk>.*)/audio/$',
             SeminarMediaView.as_view(template_name='teleforma/seminar_media_audio.html'),
             name="teleforma-media-audio"),
-    url(r'^desk/seminars/(?P<pk>.*)/preview/$', 
-            SeminarMediaPreviewView.as_view(), 
+    url(r'^desk/seminars/(?P<pk>.*)/preview/$',
+            SeminarMediaPreviewView.as_view(),
             name="teleforma-media-preview-video"),
 
     url(r'^desk/documents/(?P<pk>.*)/detail/$', DocumentView.as_view(),
@@ -97,7 +97,7 @@ urlpatterns = patterns('',
         name="teleforma-conference-record"),
 
     # Questions
-    url(r'^desk/questions/(?P<pk>.*)/$', AnswerView.as_view(),
+    url(r'^desk/seminars/(?P<id>.*)/questions/(?P<pk>.*)/$', AnswerView.as_view(),
         name="teleforma-question-answer"),
     url(r'^desk/answers/$', AnswersView.as_view(), name="teleforma-answers"),
     url(r'^desk/answers/(?P<pk>.*)/$', AnswerDetailView.as_view(), name="teleforma-answer-detail"),
@@ -107,11 +107,11 @@ urlpatterns = patterns('',
     url(r'^desk/seminars/(?P<pk>.*)/form/$', evaluation_form_detail, name="teleforma-seminar-form"),
 
     # Testimonial
-    url(r'^desk/seminars/(?P<pk>.*)/testimonial/$', TestimonialView.as_view(), 
+    url(r'^desk/seminars/(?P<pk>.*)/testimonial/$', TestimonialView.as_view(),
                                                     name="teleforma-seminar-testimonial"),
-    url(r'^desk/seminars/(?P<pk>.*)/testimonial/download/$', TestimonialDownloadView.as_view(), 
+    url(r'^desk/seminars/(?P<pk>.*)/testimonial/download/$', TestimonialDownloadView.as_view(),
                                                     name="teleforma-seminar-testimonial-download"),
-    url(r'^desk/testimonials/$', TestimonialListView.as_view(), 
+    url(r'^desk/testimonials/$', TestimonialListView.as_view(),
                                                     name="teleforma-testimonials"),
 
     # Postman

diff --git a/teleforma/views/pro.py b/teleforma/views/pro.py
index a466588c0fee522b975e2d36c8c1d4594f1317b5..96d2cc7357c2f0845c603b237f41f9587f1b44dc 100644 (file)
--- a/teleforma/views/pro.py
+++ b/teleforma/views/pro.py
@@ -103,21 +103,38 @@ def set_revision(user, seminar):
     else:
         SeminarRevision.objects.create(seminar=seminar, user=user)
 
-class SeminarView(DetailView):
+
+class SeminarAccessMixin(object):
+
+    def render_to_response(self, context):
+        seminar = context['seminar']
+        if not seminar in all_seminars(self.request)['all_seminars']:
+            messages.warning(self.request, _("You do NOT have access to this resource and then have been redirected to your desk."))
+            return redirect('teleforma-desk')
+        return super(SeminarAccessMixin, self).render_to_response(context)
+
+
+class SeminarView(SeminarAccessMixin, DetailView):
 
     model = Seminar
     template_name='teleforma/seminar_detail.html'
 
     @method_decorator(login_required)
     def dispatch(self, *args, **kwargs):
+        # self.pk = kwargs.get('pk')
+        # seminar = self.get_object()
         return super(SeminarView, self).dispatch(*args, **kwargs)
 
+    # def get_object(self, queryset=None):
+    #     return Media.objects.get(id=self.pk)
+
     def get_context_data(self, **kwargs):
         context = super(SeminarView, self).get_context_data(**kwargs)
         seminar = self.get_object()
         user = self.request.user
         progress = seminar_progress(user, seminar)
         validated = seminar_validated(user, seminar)
+        context['seminar'] = seminar
         context['seminar_progress'] = progress
         context['seminar_validated'] = validated
         if progress == 100 and not validated:
@@ -133,15 +150,14 @@ class SeminarsView(ListView):
     model = Seminar
     template_name='teleforma/seminars.html'
 
-    def get_queryset(self):
-        return all_seminars(self.request, date_order=True)['all_seminars']
-
     @method_decorator(login_required)
     def dispatch(self, *args, **kwargs):
         return super(SeminarsView, self).dispatch(*args, **kwargs)
 
+    def get_queryset(self):
+        return all_seminars(self.request, date_order=True)['all_seminars']
 
-class AnswerView(FormView):
+class AnswerView(SeminarAccessMixin, FormView):
 
     model = Answer
     form_class = AnswerForm
@@ -190,7 +206,7 @@ class AnswerView(FormView):
         return reverse('teleforma-seminar-detail', kwargs={'pk':self.question.seminar.id})
 
 
-class SeminarMediaView(MediaView):
+class SeminarMediaView(SeminarAccessMixin, MediaView):
 
     template_name = 'teleforma/seminar_media_video.html'