fix breach in award points that allows user to award infinite points

[osqa.git] / forum / settings / forms.py

diff --git a/forum/settings/forms.py b/forum/settings/forms.py
index 337dea134961083319b5e38f95b243b0fdf61df9..3e3cc5afbf92833045346342b74d5b5c090df4aa 100644 (file)
--- a/forum/settings/forms.py
+++ b/forum/settings/forms.py
@@ -1,32 +1,58 @@
 import os
 import os

+from string import strip

 from django import forms
 from django import forms

-from base import Setting, StringSetting, IntegerSetting, BoolSetting, FloatSetting
+from forum.settings.base import Setting

 from django.utils.translation import ugettext as _
 from django.core.files.storage import FileSystemStorage
 from django.utils.translation import ugettext as _
 from django.core.files.storage import FileSystemStorage

+from django.core.urlresolvers import reverse
+
+class DummySetting:
+    pass
+
+class UnfilteredField(forms.CharField):
+    def clean(self, value):
+            return value
+

 
 class SettingsSetForm(forms.Form):
 
 class SettingsSetForm(forms.Form):

-    def __init__(self, set, data=None, *args, **kwargs):
-        if data is None:
-            data = dict([(setting.name, setting.value) for setting in set])
+    def __init__(self, set, data=None, unsaved=None, *args, **kwargs):
+        initial = dict([(setting.name, setting.value) for setting in set])

 
 

-        super(SettingsSetForm, self).__init__(data, *args, **kwargs)
+        if unsaved:
+            initial.update(unsaved)
+
+        super(SettingsSetForm, self).__init__(data, initial=initial, *args, **kwargs)

 
         for setting in set:
 
         for setting in set:

-            if isinstance(setting, StringSetting):
+            widget = setting.field_context.get('widget', None)
+
+            if widget is forms.CheckboxSelectMultiple or widget is forms.SelectMultiple or isinstance(widget, forms.SelectMultiple):
+                field = forms.MultipleChoiceField(**setting.field_context)
+            elif widget is forms.RadioSelect or isinstance(widget, forms.RadioSelect):
+                field = forms.ChoiceField(**setting.field_context)
+            elif isinstance(setting, (Setting.emulators.get(str, DummySetting), Setting.emulators.get(unicode, DummySetting))):
+                if not setting.field_context.get('widget', None):
+                    setting.field_context['widget'] = forms.TextInput(attrs={'class': 'longstring'})

                 field = forms.CharField(**setting.field_context)
                 field = forms.CharField(**setting.field_context)

-            elif isinstance(setting, FloatSetting):
+            elif isinstance(setting, Setting.emulators.get(float, DummySetting)):

                 field = forms.FloatField(**setting.field_context)
                 field = forms.FloatField(**setting.field_context)

-            elif isinstance(setting, IntegerSetting):
+            elif isinstance(setting, Setting.emulators.get(int, DummySetting)):

                 field = forms.IntegerField(**setting.field_context)
                 field = forms.IntegerField(**setting.field_context)

-            elif isinstance(setting, BoolSetting):
+            elif isinstance(setting, Setting.emulators.get(bool, DummySetting)):

                 field = forms.BooleanField(**setting.field_context)
             else:
                 field = forms.BooleanField(**setting.field_context)
             else:

-                field = forms.CharField(**setting.field_context)
+                field = UnfilteredField(**setting.field_context)

 
             self.fields[setting.name] = field
 
         self.set = set
 
 
             self.fields[setting.name] = field
 
         self.set = set
 

+    def as_table(self):
+        return self._html_output(
+                u'<tr><th>%(label)s' + ('<br /><a class="fieldtool context" href="#">%s</a><span class="sep">|</span><a class="fieldtool default" href="#">%s</a></th>' % (
+                    _('context'), _('default'))) + u'<td>%(errors)s%(field)s%(help_text)s</td>',
+                u'<tr><td colspan="2">%s</td></tr>', '</td></tr>', u'<br />%s', False)
+

     def save(self):
         for setting in self.set:
             setting.set_value(self.cleaned_data[setting.name])
     def save(self):
         for setting in self.set:
             setting.set_value(self.cleaned_data[setting.name])


@@ -60,4 +86,55 @@ class ImageFormWidget(forms.Widget):
             elif name in data:
                 return data[name]
 
             elif name in data:
                 return data[name]
 

+class StringListWidget(forms.Widget):
+    def render(self, name, value, attrs=None):
+        ret = ""
+        for s in value:
+            ret += """
+            <div class="string-list-input">
+                <input type="text" name="%(name)s" value="%(value)s" />
+                <button class="string_list_widget_button">-</button>
+            </div>
+            """  % {'name': name, 'value': s}
+
+        return """
+            <div class="string_list_widgets">
+                %(ret)s
+                <div><button name="%(name)s" class="string_list_widget_button add">+</button></div>
+            </div>
+            """ % dict(name=name, ret=ret)
+
+    def value_from_datadict(self, data, files, name):
+        if 'submit' in data:
+            return data.getlist(name)
+        else:
+            return data[name]
+
+class CommaStringListWidget(forms.Textarea):
+    def render(self, name, value, attrs=None):
+        return super(CommaStringListWidget, self).render(name, ', '.join(value), attrs)
+
+
+    def value_from_datadict(self, data, files, name):
+        if 'submit' in data:
+            return map(strip, data[name].split(','))
+        else:
+            return ', '.join(data[name])    
+
+class TestEmailSettingsWidget(forms.TextInput):
+    def render(self, name, value, attrs=None):
+        if not value:
+            value = ''
+
+        return """
+            <div id="test_email_settings">
+                <a href="%s" onclick="return false;" class="button test_button" href="/">Test</a>

 
 

+                <div style="margin-top: 7px">
+                <div style="display: none" class="ajax_indicator">
+                    Testing your current e-mail settings. Please, wait.
+                </div>
+                <div class="test_status"></div>
+                </div>
+            </div>
+            """ % reverse("test_email_settings")
\ No newline at end of file