Some other user private stuff was not being properly checked.

git-svn-id: http://svn.osqa.net/svnroot/osqa/trunk@90 0cfe37f9-358a-4d5e-be75-b63607b5c754

diff --git a/forum/views/auth.py b/forum/views/auth.py
index ca8d716fc6457d25d2d2ebbb81f167ab55e93152..cda0a81465011bcae70dc8f1d62a73c90ffad685 100644 (file)
--- a/forum/views/auth.py
+++ b/forum/views/auth.py
@@ -313,7 +313,7 @@ def auth_settings(request):
 def remove_external_provider(request, id):
     association = get_object_or_404(AuthKeyUserAssociation, id=id)
     if not association.user == request.user:
 def remove_external_provider(request, id):
     association = get_object_or_404(AuthKeyUserAssociation, id=id)
     if not association.user == request.user:

-        raise HttpResponseForbidden()
+        return HttpResponseForbidden()

     request.user.message_set.create(message=_("You removed the association with %s") % association.provider)
     association.delete()
     return HttpResponseRedirect(reverse('user_authsettings'))
     request.user.message_set.create(message=_("You removed the association with %s") % association.provider)
     association.delete()
     return HttpResponseRedirect(reverse('user_authsettings'))

diff --git a/forum/views/users.py b/forum/views/users.py
index c64764ebf10a3bbff6aa1690b8d56db20f65d64c..543d5c79b47589330b7474113729372e1ac53aed 100644 (file)
--- a/forum/views/users.py
+++ b/forum/views/users.py
@@ -135,10 +135,13 @@ def edit_user(request, id):
 \r
 \r
 \r
 \r
 \r
 \r

-def user_view(template, tab_name, tab_description, page_title):\r
+def user_view(template, tab_name, tab_description, page_title, private=False):\r

     def decorator(fn):\r
         def decorated(request, id, slug=None):\r
     def decorator(fn):\r
         def decorated(request, id, slug=None):\r

-            context = fn(request, get_object_or_404(User, id=id))\r
+            user = get_object_or_404(User, id=id)\r
+            if private and not user == request.user:\r
+                return HttpResponseForbidden()\r
+            context = fn(request, user)\r

             context.update({\r
                 "tab_name" : tab_name,\r
                 "tab_description" : tab_description,\r
             context.update({\r
                 "tab_name" : tab_name,\r
                 "tab_description" : tab_description,\r


@@ -193,7 +196,7 @@ def user_recent(request, user):
     return {"view_user" : user, "activities" : activities}\r
 \r
 \r
     return {"view_user" : user, "activities" : activities}\r
 \r
 \r

-@user_view('users/votes.html', 'votes', _('user vote record'), _('profile - votes'))\r
+@user_view('users/votes.html', 'votes', _('user vote record'), _('profile - votes'), True)\r

 def user_votes(request, user):\r
     votes = user.votes.exclude(node__deleted=True).order_by('-voted_at')[:USERS_PAGE_SIZE]\r
 \r
 def user_votes(request, user):\r
     votes = user.votes.exclude(node__deleted=True).order_by('-voted_at')[:USERS_PAGE_SIZE]\r
 \r


@@ -211,13 +214,13 @@ def user_reputation(request, user):
 \r
     return {"view_user": user, "reputation": reputation, "graph_data": graph_data}\r
 \r
 \r
     return {"view_user": user, "reputation": reputation, "graph_data": graph_data}\r
 \r

-@user_view('users/questions.html', 'favorites', _('favorite questions'),  _('profile - favorite questions'))\r
+@user_view('users/questions.html', 'favorites', _('favorite questions'),  _('profile - favorite questions'), True)\r

 def user_favorites(request, user):\r
     questions = user.favorite_questions.filter(deleted=False)\r
 \r
     return {"questions" : questions, "view_user" : user}\r
 \r
 def user_favorites(request, user):\r
     questions = user.favorite_questions.filter(deleted=False)\r
 \r
     return {"questions" : questions, "view_user" : user}\r
 \r

-@user_view('users/subscriptions.html', 'subscriptions', _('subscription settings'), _('profile - subscriptions'))\r
+@user_view('users/subscriptions.html', 'subscriptions', _('subscription settings'), _('profile - subscriptions'), True)\r

 def user_subscriptions(request, user):\r
     if request.method == 'POST':\r
         form = SubscriptionSettingsForm(request.POST)\r
 def user_subscriptions(request, user):\r
     if request.method == 'POST':\r
         form = SubscriptionSettingsForm(request.POST)\r