klmp200/Sith
1
0
Fork 0
mirror of https://github.com/ae-utbm/sith.git synced 2024-11-25 18:44:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Avoid unothorised customer to buy in counter by modifying url

Browse Source
This commit is contained in:
Antoine Bartuccio 2017-03-27 23:24:25 +02:00
parent 5eb1e609cc
commit ccd67e50b8
2 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
counter/models.py
View File

@ -6,7 +6,7 @@ from django.core.urlresolvers import reverse
from django.forms import ValidationError from django.forms import ValidationError
from django.contrib.sites.shortcuts import get_current_site from django.contrib.sites.shortcuts import get_current_site
from datetime import timedelta from datetime import timedelta, date
import random import random
import string import string
import os import os
@ -35,6 +35,11 @@ class Customer(models.Model):
def __str__(self): def __str__(self):
return "%s - %s" % (self.user.username, self.account_id) return "%s - %s" % (self.user.username, self.account_id)
@property
def can_buy(self):
return (self.user.subscriptions.last() and
(date.today() - self.user.subscriptions.last().subscription_end) < timedelta(days=90))
def generate_account_id(number): def generate_account_id(number):
number = str(number) number = str(number)
letter = random.choice(string.ascii_lowercase) letter = random.choice(string.ascii_lowercase)

15
counter/views.py
View File

@ -1,4 +1,5 @@
from django.shortcuts import render from django.shortcuts import render, get_object_or_404
from django.http import Http404
from django.core.exceptions import PermissionDenied from django.core.exceptions import PermissionDenied
from django.views.generic import ListView, DetailView, RedirectView, TemplateView from django.views.generic import ListView, DetailView, RedirectView, TemplateView
from django.views.generic.edit import UpdateView, CreateView, DeleteView, ProcessFormView, FormMixin from django.views.generic.edit import UpdateView, CreateView, DeleteView, ProcessFormView, FormMixin
@ -49,9 +50,7 @@ class GetUserForm(forms.Form):
cus = Customer.objects.filter(account_id__iexact=cleaned_data['code']).first() cus = Customer.objects.filter(account_id__iexact=cleaned_data['code']).first()
elif cleaned_data['id'] is not None: elif cleaned_data['id'] is not None:
cus = Customer.objects.filter(user=cleaned_data['id']).first() cus = Customer.objects.filter(user=cleaned_data['id']).first()
sub = cus.user if cus is not None else None if (cus is None or not cus.can_buy):
if (cus is None or sub is None or not sub.subscriptions.last() or
(date.today() - sub.subscriptions.last().subscription_end) > timedelta(days=90)):
raise forms.ValidationError(_("User not found")) raise forms.ValidationError(_("User not found"))
cleaned_data['user_id'] = cus.user.id cleaned_data['user_id'] = cus.user.id
cleaned_data['user'] = cus.user cleaned_data['user'] = cus.user
@ -159,9 +158,14 @@ class CounterClick(CounterTabsMixin, CanViewMixin, DetailView):
pk_url_kwarg = "counter_id" pk_url_kwarg = "counter_id"
current_tab = "counter" current_tab = "counter"
def dispatch(self, request, *args, **kwargs):
self.customer = get_object_or_404(Customer, user__id=self.kwargs['user_id'])
if not self.customer.can_buy:
raise Http404
return super(CounterClick, self).dispatch(request, *args, **kwargs)
def get(self, request, *args, **kwargs): def get(self, request, *args, **kwargs):
"""Simple get view""" """Simple get view"""
self.customer = Customer.objects.filter(user__id=self.kwargs['user_id']).first()
if 'basket' not in request.session.keys(): # Init the basket session entry if 'basket' not in request.session.keys(): # Init the basket session entry
request.session['basket'] = {} request.session['basket'] = {}
request.session['basket_total'] = 0 request.session['basket_total'] = 0
@ -180,7 +184,6 @@ class CounterClick(CounterTabsMixin, CanViewMixin, DetailView):
def post(self, request, *args, **kwargs): def post(self, request, *args, **kwargs):
""" Handle the many possibilities of the post request """ """ Handle the many possibilities of the post request """
self.object = self.get_object() self.object = self.get_object()
self.customer = Customer.objects.filter(user__id=self.kwargs['user_id']).first()
self.refill_form = None self.refill_form = None
if ((self.object.type != "BAR" and not request.user.is_authenticated()) or if ((self.object.type != "BAR" and not request.user.is_authenticated()) or
(self.object.type == "BAR" and (self.object.type == "BAR" and