Conservancy/symposion_app
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Don't show unpublished schedule info to non-staff.

Browse source 
Add checks to schedule_list, schedule_list_csv, and
schedule_presentation_detail views to verify that either schedule is
published or that current user is staff before displaying information.

See c7592bc33e.
This commit is contained in:
Martey Dodoo 2016-02-20 08:20:09 -05:00
parent 47b65ac330
commit 6b41b5c477
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
symposion/schedule/views.py
View file

@ -69,6 +69,8 @@ def schedule_detail(request, slug=None):
def schedule_list(request, slug=None): def schedule_list(request, slug=None):
schedule = fetch_schedule(slug) schedule = fetch_schedule(slug)
if not schedule.published and not request.user.is_staff:
raise Http404()
presentations = Presentation.objects.filter(section=schedule.section) presentations = Presentation.objects.filter(section=schedule.section)
presentations = presentations.exclude(cancelled=True) presentations = presentations.exclude(cancelled=True)
@ -82,6 +84,8 @@ def schedule_list(request, slug=None):
def schedule_list_csv(request, slug=None): def schedule_list_csv(request, slug=None):
schedule = fetch_schedule(slug) schedule = fetch_schedule(slug)
if not schedule.published and not request.user.is_staff:
raise Http404()
presentations = Presentation.objects.filter(section=schedule.section) presentations = Presentation.objects.filter(section=schedule.section)
presentations = presentations.exclude(cancelled=True).order_by("id") presentations = presentations.exclude(cancelled=True).order_by("id")
@ -169,6 +173,8 @@ def schedule_presentation_detail(request, pk):
presentation = get_object_or_404(Presentation, pk=pk) presentation = get_object_or_404(Presentation, pk=pk)
if presentation.slot: if presentation.slot:
schedule = presentation.slot.day.schedule schedule = presentation.slot.day.schedule
if not schedule.published and not request.user.is_staff:
raise Http404()
else: else:
schedule = None schedule = None