From 38026025af1f1b30dda61b7988f3eeaaa9ce5dea Mon Sep 17 00:00:00 2001
From: Skia <skia@libskia.so>
Date: Tue, 13 Jun 2017 00:35:49 +0200
Subject: [PATCH] trombi: add safeguard on user deletion

Signed-off-by: Skia <skia@libskia.so>
---
 trombi/models.py                     |  3 +++
 trombi/templates/trombi/detail.jinja |  2 +-
 trombi/urls.py                       |  2 +-
 trombi/views.py                      | 17 +++++++----------
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/trombi/models.py b/trombi/models.py
index 6f012290..bfe9ca3d 100644
--- a/trombi/models.py
+++ b/trombi/models.py
@@ -99,6 +99,9 @@ class TrombiUser(models.Model):
     def __str__(self):
         return str(self.user)
 
+    def is_owned_by(self, user):
+        return user.is_owner(self.trombi)
+
     def make_memberships(self):
         self.memberships.all().delete()
         for m in self.user.memberships.filter(role__gt=settings.SITH_MAXIMUM_FREE_ROLE).order_by('end_date'):
diff --git a/trombi/templates/trombi/detail.jinja b/trombi/templates/trombi/detail.jinja
index c9503b0e..d451525a 100644
--- a/trombi/templates/trombi/detail.jinja
+++ b/trombi/templates/trombi/detail.jinja
@@ -25,7 +25,7 @@
                 <img src="{{ file }}" alt="" style="max-width: 100px">
             </div>
             <div>{{ u.user.get_display_name() }}</div>
-            <div><a href="{{ url('trombi:delete_user', trombi_id=object.id, user_id=u.id) }}">{% trans %}Delete{% endtrans %}</a></div>
+            <div><a href="{{ url('trombi:delete_user', user_id=u.id) }}">{% trans %}Delete{% endtrans %}</a></div>
         </div>
     {% endfor %}
     </div>
diff --git a/trombi/urls.py b/trombi/urls.py
index 984b1fc2..8a41fc66 100644
--- a/trombi/urls.py
+++ b/trombi/urls.py
@@ -31,7 +31,7 @@ urlpatterns = [
     url(r'^(?P<trombi_id>[0-9]+)/edit$', TrombiEditView.as_view(), name='edit'),
     url(r'^(?P<trombi_id>[0-9]+)/moderate_comments$', TrombiModerateCommentsView.as_view(), name='moderate_comments'),
     url(r'^(?P<comment_id>[0-9]+)/moderate$', TrombiModerateCommentView.as_view(), name='moderate_comment'),
-    url(r'^(?P<trombi_id>[0-9]+)/delete/(?P<user_id>[0-9]+)$', TrombiDeleteUserView.as_view(), name='delete_user'),
+    url(r'^user/(?P<user_id>[0-9]+)/delete$', TrombiDeleteUserView.as_view(), name='delete_user'),
     url(r'^(?P<trombi_id>[0-9]+)$', TrombiDetailView.as_view(), name='detail'),
     url(r'^(?P<user_id>[0-9]+)/new_comment$', TrombiCommentCreateView.as_view(), name='new_comment'),
     url(r'^(?P<user_id>[0-9]+)/profile$', UserTrombiProfileView.as_view(), name='user_profile'),
diff --git a/trombi/views.py b/trombi/views.py
index e2727309..b1f0efab 100644
--- a/trombi/views.py
+++ b/trombi/views.py
@@ -118,17 +118,14 @@ class TrombiDetailView(CanEditMixin, QuickNotifMixin, TrombiTabsMixin, DetailVie
     pk_url_kwarg = 'trombi_id'
     current_tab = "admin_tools"
 
-class TrombiDeleteUserView(CanEditPropMixin, SingleObjectMixin, RedirectView):
-    model = Trombi
-    pk_url_kwarg = 'trombi_id'
-    permanent = False
+class TrombiDeleteUserView(CanEditPropMixin, TrombiTabsMixin, DeleteView):
+    model = TrombiUser
+    pk_url_kwarg = 'user_id'
+    template_name = 'core/delete_confirm.jinja'
+    current_tab = "admin_tools"
 
-    def get(self, request, *args, **kwargs):
-        self.object = self.get_object()
-        user = get_object_or_404(TrombiUser, id=self.kwargs['user_id'])
-        user.delete()
-# See if we need to also delete the comments on the user, or if we keep them
-        return redirect(self.object.get_absolute_url()+"?qn_success")
+    def get_success_url(self):
+        return reverse('trombi:detail', kwargs={'trombi_id': self.object.trombi.id}) + "?qn_success"
 
 class TrombiModerateCommentsView(CanEditPropMixin, QuickNotifMixin, TrombiTabsMixin, DetailView):
     model = Trombi