Mise à jour d'avril (#643)

core/views/__init__.py

@@ -162,7 +162,6 @@ class GenericContentPermissionMixinBuilder(View):
         return cls.permission_function(obj, user)
 
     def dispatch(self, request, *arg, **kwargs):
-
         if hasattr(self, "get_object") and callable(self.get_object):
             self.object = self.get_object()
             if not self.get_permission_function(self.object, request.user):

core/views/files.py

@@ -23,7 +23,7 @@ from django.views.generic.detail import SingleObjectMixin
 from django.forms.models import modelform_factory
 from django.conf import settings
 from django.utils.translation import gettext_lazy as _
-from django.http import HttpResponse
+from django.http import Http404, HttpResponse
 from wsgiref.util import FileWrapper
 from django.urls import reverse
 from django.core.exceptions import PermissionDenied
@@ -34,7 +34,12 @@ import os
 from ajax_select import make_ajax_field
 
 from core.models import SithFile, RealGroup, Notification
-from core.views import CanViewMixin, CanEditMixin, CanEditPropMixin, can_view, not_found
+from core.views import (
+    CanViewMixin,
+    CanEditMixin,
+    CanEditPropMixin,
+    can_view,
+)
 from counter.models import Counter
 
 
@@ -58,6 +63,11 @@ def send_file(request, file_id, file_class=SithFile, file_attr="file"):
         raise PermissionDenied
     name = f.__getattribute__(file_attr).name
     filepath = os.path.join(settings.MEDIA_ROOT, name)
+
+    # check if file exists on disk
+    if not os.path.exists(filepath.encode("utf-8")):
+        raise Http404()
+
     with open(filepath.encode("utf-8"), "rb") as filename:
         wrapper = FileWrapper(filename)
         response = HttpResponse(wrapper, content_type=f.mime_type)
@@ -152,6 +162,13 @@ class FileEditView(CanEditMixin, UpdateView):
     template_name = "core/file_edit.jinja"
     context_object_name = "file"
 
+    def get(self, request, *args, **kwargs):
+        self.object = self.get_object()
+        if not self.object.can_be_managed_by(request.user):
+            raise PermissionDenied
+
+        return super(FileEditView, self).get(request, *args, **kwargs)
+
     def get_form_class(self):
         fields = ["name", "is_moderated"]
         if self.object.is_file:
@@ -197,6 +214,13 @@ class FileEditPropView(CanEditPropMixin, UpdateView):
     context_object_name = "file"
     form_class = FileEditPropForm
 
+    def get(self, request, *args, **kwargs):
+        self.object = self.get_object()
+        if not self.object.can_be_managed_by(request.user):
+            raise PermissionDenied
+
+        return super(FileEditPropView, self).get(request, *args, **kwargs)
+
     def get_form(self, form_class=None):
         form = super(FileEditPropView, self).get_form(form_class)
         form.fields["parent"].queryset = SithFile.objects.filter(is_folder=True)
@@ -269,6 +293,9 @@ class FileView(CanViewMixin, DetailView, FormMixin):
 
     def get(self, request, *args, **kwargs):
         self.form = self.get_form()
+        if not self.object.can_be_managed_by(request.user):
+            raise PermissionDenied
+
         if "clipboard" not in request.session.keys():
             request.session["clipboard"] = []
         return super(FileView, self).get(request, *args, **kwargs)
@@ -316,6 +343,13 @@ class FileDeleteView(CanEditPropMixin, DeleteView):
     template_name = "core/file_delete_confirm.jinja"
     context_object_name = "file"
 
+    def get(self, request, *args, **kwargs):
+        self.object = self.get_object()
+        if not self.object.can_be_managed_by(request.user):
+            raise PermissionDenied
+
+        return super(FileDeleteView, self).get(request, *args, **kwargs)
+
     def get_success_url(self):
         self.object.file.delete()  # Doing it here or overloading delete() is the same, so let's do it here
         if "next" in self.request.GET.keys():

core/views/page.py

@@ -82,6 +82,11 @@ class PageRevView(CanViewMixin, DetailView):
 
     def dispatch(self, request, *args, **kwargs):
         res = super(PageRevView, self).dispatch(request, *args, **kwargs)
+        self.object = self.get_object()
+
+        if self.object is None:
+            return redirect("core:page_create", page_name=self.kwargs["page_name"])
+
         if self.object.need_club_redirection:
             return redirect(
                 "club:club_view_rev", club_id=self.object.club.id, rev_id=kwargs["rev"]

core/views/site.py

@@ -31,6 +31,7 @@ from django.utils import html
 from django.views.generic import ListView, TemplateView
 from django.conf import settings
 from django.utils.text import slugify
+from django.db.models.query import QuerySet
 
 import json
 
@@ -51,12 +52,15 @@ class NotificationList(ListView):
     model = Notification
     template_name = "core/notification_list.jinja"
 
-    def get_queryset(self):
+    def get_queryset(self) -> QuerySet[Notification]:
+        if self.request.user.is_anonymous:
+            return Notification.objects.none()
         # TODO: Bulk update in django 2.2
         if "see_all" in self.request.GET.keys():
             for n in self.request.user.notifications.filter(viewed=False):
                 n.viewed = True
                 n.save()
+
         return self.request.user.notifications.order_by("-date")[:20]
 
 

core/views/user.py

@@ -254,10 +254,11 @@ class UserTabsMixin(TabedViewMixin):
             if user.customer and (
                 user == self.request.user
                 or self.request.user.is_in_group(
-                    settings.SITH_GROUP_ACCOUNTING_ADMIN_ID
+                    pk=settings.SITH_GROUP_ACCOUNTING_ADMIN_ID
                 )
                 or self.request.user.is_in_group(
-                    settings.SITH_BAR_MANAGER["unix_name"] + settings.SITH_BOARD_SUFFIX
+                    name=settings.SITH_BAR_MANAGER["unix_name"]
+                    + settings.SITH_BOARD_SUFFIX
                 )
                 or self.request.user.is_root
             ):
@@ -320,7 +321,7 @@ class UserPicturesView(UserTabsMixin, CanViewMixin, DetailView):
         last_album = None
         for picture in picture_qs:
             album = picture.parent
-            if album.id != last_album:
+            if album.id != last_album and album not in kwargs["albums"]:
                 kwargs["albums"].append(album)
                 kwargs["pictures"][album.id] = []
                 last_album = album.id
@@ -413,6 +414,7 @@ class UserGodfathersTreePictureView(CanViewMixin, DetailView):
             self.graph = pgv.AGraph(strict=False, directed=True)
         family = set()
         self.level = 1
+
         # Since the tree isn't very deep, we can build it recursively
         def crawl_family(user):
             if self.level > self.depth:
@@ -487,9 +489,9 @@ class UserStatsView(UserTabsMixin, CanViewMixin, DetailView):
 
         if not (
             profile == request.user
-            or request.user.is_in_group(settings.SITH_GROUP_ACCOUNTING_ADMIN_ID)
+            or request.user.is_in_group(pk=settings.SITH_GROUP_ACCOUNTING_ADMIN_ID)
             or request.user.is_in_group(
-                settings.SITH_BAR_MANAGER["unix_name"] + settings.SITH_BOARD_SUFFIX
+                name=settings.SITH_BAR_MANAGER["unix_name"] + settings.SITH_BOARD_SUFFIX
             )
             or request.user.is_root
         ):
@@ -717,8 +719,12 @@ class UserPreferencesView(UserTabsMixin, CanEditMixin, UpdateView):
 
     def get_context_data(self, **kwargs):
         kwargs = super(UserPreferencesView, self).get_context_data(**kwargs)
-        if not hasattr(self.object, "trombi_user"):
+
+        if not (
+            hasattr(self.object, "trombi_user") and self.request.user.trombi_user.trombi
+        ):
             kwargs["trombi_form"] = UserTrombiForm()
+
         if hasattr(self.object, "customer"):
             kwargs["student_card_form"] = StudentCardForm()
         return kwargs
@@ -771,9 +777,9 @@ class UserAccountBase(UserTabsMixin, DetailView):
         res = super(UserAccountBase, self).dispatch(request, *arg, **kwargs)
         if (
             self.object == request.user
-            or request.user.is_in_group(settings.SITH_GROUP_ACCOUNTING_ADMIN_ID)
+            or request.user.is_in_group(pk=settings.SITH_GROUP_ACCOUNTING_ADMIN_ID)
             or request.user.is_in_group(
-                settings.SITH_BAR_MANAGER["unix_name"] + settings.SITH_BOARD_SUFFIX
+                name=settings.SITH_BAR_MANAGER["unix_name"] + settings.SITH_BOARD_SUFFIX
             )
             or request.user.is_root
         ):