* Don't allow people to view each other's influences and characters.
[matthijs/projects/xerxes.git] / influences / views.py
1 from django.contrib.auth.decorators import login_required
2 from django.shortcuts import render_to_response
3 from django.shortcuts import get_object_or_404
4 from django.template import RequestContext
5 from django.utils.translation import ugettext as _
6 from django.contrib.auth.models import User
7 from django.core.urlresolvers import reverse
8 from django.http import HttpResponseRedirect, HttpResponseForbidden
9 from django.views.generic.list_detail import object_detail, object_list
10 from ee.influences.models import Character
11 from ee.influences.models import Influence
12 from ee.tools.forms import ContextModelForm
13
14
15
16 class InfluenceForm(ContextModelForm):
17     class Meta:
18         model = Influence
19         fields = ('character', 'contact', 'summary', 'description')
20
21 class CharacterForm(ContextModelForm):
22     class Meta:
23         model = Character
24         fields = ('name')
25
26 @login_required
27 def add(request, character_id=None):
28     initial = {}
29     # Get the current user's characters
30     chars = request.user.character_set.all()
31
32     if (character_id):
33         initial['character'] = character_id
34     elif (chars.count() == 1):
35         initial['character'] = chars[0].id
36
37     f = InfluenceForm(request=request, initial=initial)
38     if (f.is_valid()):
39         influence = f.save(commit=False)
40         if (influence.character.player == request.user):
41                 influence.save()
42                 return HttpResponseRedirect(reverse('influences_influence_detail', args=[influence.id]))
43         else:
44                 # TODO: Make this a bit more pretty. Perhaps throw an exception here and add some middleware to catch it?
45                 return HttpResponseForbidden("Forbidden -- Trying to submit influence for somebody else's character")
46      
47     # Only allow characters of the current user
48     f.fields['character']._set_queryset(chars)
49
50     return render_to_response('influences/add.html', {'form' : f}, RequestContext(request))
51
52 @login_required
53 def addCharacter(request):
54     f = CharacterForm(request=request)
55     if (f.is_valid()):
56         character = f.save(commit=False)
57         character.player = request.user
58         character.save()
59         return HttpResponseRedirect(reverse('influences_character_detail', args=[character.id]))
60
61     return render_to_response('influences/add_character.html', {'form' : f}, RequestContext(request))
62
63 @login_required
64 def index(request):
65     characters = request.user.character_set.all()
66     influences = Influence.objects.filter(character__in=characters)
67     return render_to_response('influences/index.html', {'characters' : characters, 'influences' : influences}, RequestContext(request))
68
69 @login_required
70 def character_list(request):
71     os = request.user.character_set.all()
72     return render_to_response('influences/character_list.html', {'object_list' : os}, RequestContext(request))
73
74 @login_required
75 def character_detail(request, object_id):
76     o = Character.objects.get(pk=object_id)
77     if (o.player != request.user):
78         return HttpResponseForbidden("Forbidden -- Trying to view somebody else's character")
79     return render_to_response('influences/character_detail.html', {'object' : o}, RequestContext(request))
80
81 @login_required
82 def influence_detail(request, object_id):
83     o = Influence.objects.get(pk=object_id)
84     if (o.character.player != request.user):
85         return HttpResponseForbidden("Forbidden -- Trying to view influences of somebody else's character")
86     return render_to_response('influences/influence_detail.html', {'object' : o}, RequestContext(request))
87
88 # vim: set sts=4 sw=4 expandtab: